🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f
SHA3-384 hash: 74ccd8f3bbbfd5511ae02071dce015227e0f6dc1ba6a033485982db6f210379f0d4c1477c8d71e7642bfe32458b2ef15
SHA1 hash: 8bc4cfdca1d24a5ad49307b5c745c3f2dc6ca97e
MD5 hash: 548f02475a40c343c774aac9e52ceca7
humanhash: fillet-beryllium-edward-social
File name:1.exe
Download: download sample
Signature HijackLoader
Create hunting rule
File size:10'911'052 bytes
First seen:2026-10-27 08:58:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash b5a014d7eeb4c2042897567e1288a095 (25 x HijackLoader, 23 x GhostPulse, 14 x ValleyRAT)
ssdeep 196608:+pyqN1KEB9XFiYz7m5SH9zJdoRtleAe9/cj6Lt5QRQ9Wi9BVIBvBblMC7eBd:+p5NwEB9XIYHmCLdq7G/tt5QRQ9Wavkg
TLSH T1DEB633A177C498F0CB65D933DE9DDB2369B3DAE8378A8517AA491C624DD3224430F0ED
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c292ecd8f2f6fe1c (24 x HijackLoader, 23 x GhostPulse, 12 x Vidar)
Reporter BlinkzSec
Tags:HIjackLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-27 11:17:42 UTC
Tags:
delphi hijackloader loader auto-startup snappyclient rat stealer
Link:
https://app.any.run/tasks/685f4a33-a5db-422f-a450-a75b48532ae7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95424/
Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae067a549621540087be586
Tags:
shellcode autorun dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a custom TCP request
Creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-27T07:10:00Z UTC
Last seen:
2026-10-28T12:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f/results?tab=lookup
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3924b1db-8887-44f8-992b-d38111aeb282
Result
Threat name:
SnappyClient
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1992502
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Contains VNC / remote desktop functionality (version string found)
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Writes to foreign memory regions
Yara detected SnappyClient
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1992502 Sample: 1.exe Startdate: 27/10/2026 Architecture: WINDOWS Score: 100 67 seo-master.club 2->67 87 Found malware configuration 2->87 89 Antivirus detection for dropped file 2->89 91 Multi AV Scanner detection for submitted file 2->91 93 2 other signatures 2->93 11 1.exe 15 2->11         started        14 rundll32.exe 2->14         started        signatures3 process4 file5 59 C:\Users\user\AppData\...\vcruntime140.dll, PE32 11->59 dropped 61 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 11->61 dropped 63 C:\Users\user\AppData\Local\...\msvcp_win.dll, PE32 11->63 dropped 65 8 other malicious files 11->65 dropped 16 AgentCir.exe 14 11->16         started        process6 file7 45 C:\ProgramData\...\vcruntime140.dll, PE32 16->45 dropped 47 C:\ProgramData\WO_net8_debug\ucrtbase.dll, PE32 16->47 dropped 49 C:\ProgramData\WO_net8_debug\msvcp_win.dll, PE32 16->49 dropped 51 8 other malicious files 16->51 dropped 83 Switches to a custom stack to bypass stack traces 16->83 85 Found direct / indirect Syscall (likely to bypass EDR) 16->85 20 AgentCir.exe 7 16->20         started        signatures8 process9 file10 53 C:\Users\user\AppData\Local\Temp\9DC1.tmp, PE32 20->53 dropped 55 C:\Users\user\AppData\Local\KernelFor.exe, PE32 20->55 dropped 95 Contains VNC / remote desktop functionality (version string found) 20->95 97 Found hidden mapped module (file has been removed from disk) 20->97 99 Maps a DLL or memory area into another process 20->99 101 2 other signatures 20->101 24 KernelFor.exe 10 67 20->24         started        signatures11 process12 dnsIp13 79 seo-master.club 94.103.1.235, 3333, 3334, 49747 DHOST-ASRU Netherlands 24->79 103 Tries to harvest and steal browser information (history, passwords, etc) 24->103 105 Writes to foreign memory regions 24->105 107 Allocates memory in foreign processes 24->107 109 6 other signatures 24->109 28 chrome.exe 24->28         started        31 rundll32.exe 24->31         started        33 chrome.exe 24->33         started        35 chrome.exe 24->35         started        signatures14 process15 dnsIp16 81 192.168.2.5, 138, 3333, 3334 unknown unknown 28->81 37 chrome.exe 28->37         started        41 chrome.exe 28->41         started        43 chrome.exe 28->43         started        process17 dnsIp18 69 142.250.73.142, 443, 49801 GOOGLE-GoogleLLCUS United States 37->69 71 ogads-pa.clients6.google.com 142.250.73.74, 443, 49780, 49781 GOOGLE-GoogleLLCUS United States 37->71 77 8 other IPs or domains 37->77 57 Chrome Cache Entry: 237, PDP-11 37->57 dropped 73 142.251.152.119, 443, 49803 GOOGLE-GoogleLLCUS United States 41->73 75 android.l.google.com 41->75 file19
Score:
77%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout SFX 7z T1059.007 Win 32 Exe x86
Link:
https://app.malva.re/file/548f02475a40c343c774aac9e52ceca7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2026-10-27 08:55:35 UTC
File Type:
PE (Exe)
Extracted files:
48
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sd5pvkr6nq6rdoig3nn2wjxxkcdtko7s5nljszl7gq6e7bx2y5hq._file
Verdict:
malicious
Label(s):
HijackLoader
Create hunting rule
SIDEEYE
Create hunting rule
Link:
https://reports.threatray.com/4dcb8e2a-912e-4d66-ba39-1a86abda00af
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access defense_evasion discovery loader privilege_escalation spyware stealer
Link:
https://tria.ge/reports/261027-kw9blsby2t/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Unpacked files
SH256 hash:
90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f
MD5 hash:
548f02475a40c343c774aac9e52ceca7
SHA1 hash:
8bc4cfdca1d24a5ad49307b5c745c3f2dc6ca97e
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
05dd06cf4ed7df62dc2878b06011f2b87aa26e064f9e378c04171e2844cf0bdb
MD5 hash:
41bbb1193ed83fe0cfc2104091295bc7
SHA1 hash:
b5694b1176c7630c848618154784ae2b2cafee7b
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 hash:
c4a25dce665733663284750666684703
SHA1 hash:
368f3c3497c1b0121409216282803bcf1b64f35f
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
4d788c0de12c7a72c9031a4d4fd1e4ee4e41ee22b44c53d200f5fa3f32c1082b
MD5 hash:
2febfc2be691ba8b4a6c76dc05400b99
SHA1 hash:
7dfc97f34b21d95bffc51ef46692720125a67857
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
52b22003b0e56f8f7e0946b9079de07f3937eeda904c768bb57ba1425f5b7f50
MD5 hash:
1c90402d9d2b716f048401a6d565d5dc
SHA1 hash:
9d7671356525e32e84c0f9100045e242b42d0987
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
5319fdeae5f69ed26401d1fb79db5ded0cfa348c124404f16c1e8ca33d915599
MD5 hash:
26ab6720e55dd96edbdf59c99ffab907
SHA1 hash:
77507497918f54bdb5b63bc880fdd210f78556a0
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
5c3d7b15523faabc67ce368d38eb240581ba4edfdfb9993ca0d9277959a5e114
MD5 hash:
22bb25288ab39a86970832d4701126cd
SHA1 hash:
26722052a14b9d11da45cb2ea0f8c0dccb7d349f
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
657ab198c4035ec4b6ff6cf863c2ec99962593547af41b772593715de2df459c
MD5 hash:
b8ae902fe1909c0c725ba669074292e2
SHA1 hash:
46524eff65947cbef0e08f97c98a7b750d6077f3
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 hash:
7762c51ea02eb943183d597ea0ee5530
SHA1 hash:
0b8c307eba01d0679a2669210862d0afa888c40f
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
943b14bd9c99d95a3914b4571f2ac44d2d8f0ddf1009a2283b6f3005a3f40f5c
MD5 hash:
b2b0cfb88743f59aae52f870a70cb88c
SHA1 hash:
7cd6af6fe242fef9d565a81936a1d894fbd888e4
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
SH256 hash:
b9aefaf687812af08a5144ba4f0bc904c1adcd1ce8e84acf51bc830e74c967cc
MD5 hash:
10d9438bd24f31a41583b846583b63fc
SHA1 hash:
a3694496865cea9caf6c1089558edc1f5d9c529f
Link:
https://www.unpac.me/results/3995de71-6ad1-4bc4-99ec-7dc8a4fe6bf0/
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/90fafaaa3e6c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HijackLoader

Executable exe 90fafaaa3e6c3d11b906db5bab26f75087353bf2eb5699657f343c4f86fac74f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4035717/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/95424/

Comments