MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120
SHA3-384 hash: 3074e8944ec3ffc074c37a588cf5f86979fcab954c7a351991fe87c858732797bbf43ff33dbf5e45e7f2bbb7fb668af7
SHA1 hash: 4023304b1eeb01c0885e9df35d496c651a5b96e9
MD5 hash: d44df165f166be969c6437de200240f7
humanhash: delaware-leopard-skylark-arizona
File name:Webex_Installer.exe
Download: download sample
Signature HijackLoader
Create hunting rule
File size:12'042'992 bytes
First seen:2025-10-14 15:36:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f557cb5e3abb3bc5ede97f2a0da19e34 (2 x DeerStealer, 1 x AsyncRAT, 1 x Arechclient2)
ssdeep 196608:4i0vO069gmWn6+TtsJBPeLzfA/Js3xzl0lItEMQlsVntWh/7h3X60HlbcdvlCve:L069TWn6+qvWfo+T0Ot6oKt3X60HlbsV
Threatray 18 similar samples on MalwareBazaar
TLSH T193C6334BA7D4ECD6FA3B903D89114902F8B7FC026A24CB4B5AD519BA1F273C8693D711
TrID 92.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10522/11/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.7% (.EXE) OS/2 Executable (generic) (2029/13)
0.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter SquiblydooBlog
Tags:exe HIjackLoader signed

Code Signing Certificate

Organisation:KTNF Co., Ltd.
Issuer:SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:sha256WithRSAEncryption
Valid from:2025-05-07T02:26:52Z
Valid to:2026-05-07T02:26:52Z
Serial number: 5ac8cc211d70d37748630d6f214e61d6
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 3e56b88faa6ee894ce3df02d71eafde05438615649e2efe3c8091250f45c378f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Webex_Installer.exe
Verdict:
Malicious activity
Analysis date:
2025-10-14 15:20:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/319be0a5-77be-4e45-9cde-e529eb49b54f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32752/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ee6e4497a16d00a8d9e73b
Tags:
shellcode dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% subdirectories
DNS request
Connection attempt
Sending a custom TCP request
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc overlay signed
Link:
https://www.filescan.io/uploads/68ee705971883144ef36aa50/reports/27b708ed-6755-4fdb-852a-80147777e86a/overview
Verdict:
Suspicious
Labled as:
Trojan.Penguish
Link:
https://www.hybrid-analysis.com/sample/d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-10-13T13:51:00Z UTC
Last seen:
2025-10-13T15:56:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/76f12de9-52cf-4fbd-92f0-37fbcb3f6216
Score:
51%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/d44df165f166be969c6437de200240f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=27s35cvgpmz5ttlidqjgyvjdzemwslxujl3jwryn54eghuxsqeqa._file
Verdict:
malicious
Label(s):
hijackloader
Create hunting rule
Similar samples:
356c86d7bd72fa4fcb23d2276e07a854d1b92a49b3b7752adb915720a1e2668f
HijackLoader
72acf597de6ade41537a8d9d153e89064168ed780feeffc66ecf3081922fd87d
HijackLoader
7dfe8d25b80b42ba7834c671f91956652ba929a239056bfc4321622eab60de3e
HijackLoader
aab194f10b0bf13879177d42e353d4f6e82dd61e530a26dd9b3727d31c0263af
HijackLoader
ad81b2f47eefcdce16dfa85d8d04f5f8b3b619ca31a14273da6773847347bec8
HijackLoader
bcc062030c3615d3f8e42e3a2a0b4410e07cf5c845c72c95b56d41d81bac5f46
HijackLoader
c8251d1aba99075ce6f8f735b72015c2589e936bcdf544f87c5947324ec8b056
HijackLoader
da2d70296366c0de38701eb844e7ba52b6e7f7ee700c9854af05421fa75973e6
HijackLoader
error
HijackLoader
f2a068164ed7b173f17abe52ad95c53bccf3bb9966d75027d1e8960f7e0d43ac
HijackLoader
+ 8 additional samples on MalwareBazaar
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader adware defense_evasion discovery loader persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/251014-s7v75ahv6a/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
UPX packed file
Adds Run key to start application
Checks installed software on the system
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Detects HijackLoader (aka IDAT Loader)
HijackLoader
Hijackloader family
Verdict:
Malicious
Tags:
Win.Malware.Wingo-10036258-0
YARA:
n/a
Link:
https://app.threat.zone/submission/5f99038b-e164-44f8-9115-a291480671fd
Unpacked files
SH256 hash:
d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120
MD5 hash:
d44df165f166be969c6437de200240f7
SHA1 hash:
4023304b1eeb01c0885e9df35d496c651a5b96e9
Link:
https://www.unpac.me/results/09bb73c0-65df-4132-95e5-3b10837d4e96/
SH256 hash:
43709bb4b709dd808589f785cf68107e1338568a2579ae25628d27dc6a3e0ab1
MD5 hash:
ddb35ff481076fb0646e368cd68b3701
SHA1 hash:
ca77b63c07079be0776e0eafef3ab460c6ad7e29
Link:
https://www.unpac.me/results/09bb73c0-65df-4132-95e5-3b10837d4e96/
SH256 hash:
c1e6c3d8935c9891dac606d3afa7a5346e76a211be6d1dc35555acfe0c60c403
MD5 hash:
0c3b499fc9539ff7e948922cc3bf9568
SHA1 hash:
35167d64993027606b1a786fa134925b6fcfc9b1
Link:
https://www.unpac.me/results/09bb73c0-65df-4132-95e5-3b10837d4e96/
SH256 hash:
ec4c0a87ec82e97e0d6d32e6c5e78b472bf203861fff5052e4b1ae2ed14b48de
MD5 hash:
4a32867e4a48eae4f12013d3061fa1c2
SHA1 hash:
c948352e6cf19b4fe0d321487af39afd48610fa6
Link:
https://www.unpac.me/results/09bb73c0-65df-4132-95e5-3b10837d4e96/
Malware family:
IDATLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d7e5be8aa67b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7e5be8aa67b33d9cd681c126c5523c919692ef44af69b470def0863d2f28120

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Sandworm_ArguePatch_Apr_2022_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MAL_packer_lb_was_detected
Create hunting rule
Author:0x0d4y
Description:Detect the packer used by Lockbit4.0
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32752/

Comments