MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
SHA3-384 hash: fdb35a505c9a593bc8291677fe3c3829631696af200e4b6e76af59356a74f3981fed20eeb1eb4612e33a1b9dc3dd35ff
SHA1 hash: 459803e9570904544d4652707ea4d6692a746b39
MD5 hash: f5917c4cf6e4238516489dfdf4b02455
humanhash: yellow-jig-coffee-indigo
File name:file
Download: download sample
Signature HijackLoader
Create hunting rule
File size:6'524'734 bytes
First seen:2026-07-16 18:05:41 UTC
Last seen:2026-07-17 04:49:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 20dd26497880c05caed9305b3c8b9109 (31 x Adware.Auslogics, 28 x HijackLoader, 5 x Adware.IObit)
ssdeep 98304:JJoRb3aK2ayBzvcDSbgp1+8WES51qPzXQi3kjA8oyIG4hcDzGTkvIs04LxulqLxj:JEadBzuSbgK8WtG3kjpxSSzGT+9YqLxj
TLSH T10266330767D210F6FC325A3624188120EE3D786C4BF5952D1EF6C2AD9F39784CEB2A95
TrID 72.8% (.EXE) Inno Setup installer (107240/4/30)
9.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win64 Executable (generic) (6522/11/2)
3.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b298acbab2ca7a72 (2'335 x GCleaner, 1'824 x Socks5Systemz, 67 x RedLineStealer)
Reporter Bitsight
Tags:a dropped-by-gcleaner exe HIjackLoader MIX9.file


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
4
# of downloads :
171
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/071f2739-765d-4be6-90ff-df7762e3d0d5/
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74932/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a591d84b3055706bb5579b6
Tags:
dropper ramnit crypt smtp
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-16T15:51:00Z UTC
Last seen:
2026-07-18T14:45:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065/results?tab=lookup
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d2509cf6-1bf6-4893-8c6b-9df75e527b05
Score:
15%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/f5917c4cf6e4238516489dfdf4b02455
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-16 18:06:42 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gsdxzokj3fdf36kmrj7p3dqeltrfza25mxghzexl67gcigv7kbsq._file
Verdict:
malicious
Label(s):
TinyUtility
Create hunting rule
Link:
https://reports.threatray.com/0bec8e75-28c6-44e4-94ab-6ef09f5f7bee
Similar samples:
108d5bc2024134624ebfd2f221e636e9d2fd8e4505fa1817387e543cddc76d58
HijackLoader
4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc
HijackLoader
6dcba233968441cbb50e14bace526d0a22e0947b392973332d94166a9a064a1a
HijackLoader
70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
HijackLoader
957c3fc02297170cea63f95c640c63954774ed5b25be4bb9f40f14b9aba1e06b
HijackLoader
be11d5551412487117465ca46654aa45ee8ed3e1b273a8978843b87b6bb3f221
HijackLoader
c88a5bba3b32d6c4cfe3c2d33ea8eb5ada10314a8e049ce02d5cda94abd5aeb8
HijackLoader
eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348
HijackLoader
ef407166a527f6f6d1584c25647bbb14b21320fdd89528ed5f517456eb12bba5
HijackLoader
fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120
HijackLoader
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access discovery installer loader spyware stealer
Link:
https://tria.ge/reports/260716-wpm1ksev5z/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Unpacked files
SH256 hash:
34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
MD5 hash:
f5917c4cf6e4238516489dfdf4b02455
SHA1 hash:
459803e9570904544d4652707ea4d6692a746b39
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
babdfd106ea4cfc48bb0b9a2db4486986a7b2bafa017453c38fb19bd340d7907
MD5 hash:
61cb4a19ad764f7bf1e8b23c5faa44d9
SHA1 hash:
0db6001e69d67eacb6294b8194098ac4a408ca8b
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
262b89956e3e647962d153c7d47e85dac879050dfefd656c99c7aad4d17495cd
MD5 hash:
7aeb2d2b4648b3bfcdf3b5a292194414
SHA1 hash:
14c9f43b0210e9e16b5f76185283ed16d126125f
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
cffd6df0fb5407e7dcdcd308e5cb6c1b26ebe5eeed8e98d744ef667770a9d2f6
MD5 hash:
559024ff034de3daa80a288f56b1ad3e
SHA1 hash:
7a1c12b97b9f6d3b7be3ad299627b2169144bd2a
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
35bcbf0e39dee5c301cf539c1d46102b06c6094fe69c39b8971ebf4fdf20ce8d
MD5 hash:
cdbe194fe15412ecc85a0359c81319e9
SHA1 hash:
99dff5e6ec2dc61e37b276e6f181db880141a4e6
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
20e80893bfc0d7327a6788b89bc97d2844d6958f4566fbfe66d13dc456ca8849
MD5 hash:
b004a408401da9093691771b1d88541a
SHA1 hash:
d0566079e8253cc74efc6f63039434d4304daa28
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
MD5 hash:
90fc739c83cd19766acb562c66a7d0e2
SHA1 hash:
451f385a53d5fed15e7649e7891e05f231ef549a
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
72cd446251fcb480db1ee748d160830e9760654bb51d0e1924dac6811b8bb28c
MD5 hash:
10fd6f0cc57d6127b1e86907f97a25ca
SHA1 hash:
0f58251807136044c4857668c62eccb73cfa5c58
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
Parent samples :
a8ca24a38e697ee4c2864e3c9c129101ba0c3394b5f173c23d1a599bb91d19e1
34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f
SH256 hash:
08a93ad91061aeda02121ae6a4fc9ec024f612e39626c615fd5f3765957608a4
MD5 hash:
2e259afb699d02eecfa0817e791e3324
SHA1 hash:
3873b36b6b1257dfa6543124383e932d553126a4
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/7f975056-be27-48d8-ac25-3d361747468c/
Malware family:
SHADOWLADDER
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/34877cb949d9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HijackLoader

Executable exe 34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/74932/

Comments