MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ab3080efc9f1563677b49e1c36b1937a38e4bee2f1c259d8da79c0e06ab1045. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5ab3080efc9f1563677b49e1c36b1937a38e4bee2f1c259d8da79c0e06ab1045
SHA3-384 hash:	5d2e3ee7cf3bfa0fcd51c31abac0ce83e59037edfadf9da2c63b41fe2d35bd105a9604742370098418bc60ad5cdb7d17
SHA1 hash:	159de1cad4486c37db1c0f6ac56201b97a5f2a34
MD5 hash:	1e750dd4c3d6a34a1ba0dddd4fa34772
humanhash:	wyoming-delta-alaska-equal
File name:	30-09-26_stage3.zip
Download:	download sample
Signature	HijackLoader Alert Create hunting rule
File size:	183'012'870 bytes
First seen:	2026-10-01 10:10:36 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	3145728:H9fW5mqwDxFGl2ywSuyMxe1QVkFmYbLiRwLxl1TByYo6GR7Wyidm1lqOQBar3KLR:H9fEwdwtw5VwjeREl1T4YtG0dmiOuA3E
TLSH	T1CC9833BB42578F36D4F2EE396A93831AF616847296B11C4F8D790289E60B1CC7F5580F
TrID	72.4% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 27.5% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	andrewpetrus
Tags:	electron HIjackLoader javascript main.js zip

andrewpetrus

Backdoor in resources/app/main.js which gets loaded by GitHub Desktop Electron application.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

226

Origin country :

AU

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ace99ab350c7ee8cc152bb9

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5ab3080efc9f1563677b49e1c36b1937a38e4bee2f1c259d8da79c0e06ab1045

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-10-02T07:23:00Z UTC

Last seen:

2026-10-02T07:31:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5ab3080efc9f1563677b49e1c36b1937a38e4bee2f1c259d8da79c0e06ab1045/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/5ab3080efc9f1563677b49e1c36b1937a38e4bee2f1c259d8da79c0e06ab1045

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lkzqqdx4t4kwgz33jhq4g2yzg6ry4s7of4oclhmnu6oa4bvlcbcq._file

Hatching Triage hijackloader

Result

Malware family:

hijackloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:hijackloader adware antivm credential_access defense_evasion discovery execution linux loader persistence privilege_escalation spyware stealer upx

Link:

https://tria.ge/reports/261001-m7hzxa1wcw/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

Reads user/profile data of web browsers

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Program Files directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

UPX packed file

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Enumerates connected drives

Unsecured Credentials: Credentials In Files

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2026-10-01 10:53:51 UTC

https://x.com/AndrewPetrus/status/2105611929096167912?s=20