MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e
SHA3-384 hash: 04650deb79045dfcfff3208c65aa2e77fc5fd8f9fb710254bffcd9f2b1ce77840a17c7eb4dfe54f7c56f977d57b63b88
SHA1 hash: 5e265395ad38c8cfd39a99ef878c7511e16d57f8
MD5 hash: 5a4ae18dd9b4e014f373e3496b4847b4
humanhash: nitrogen-one-kitten-moon
File name:file
Download: download sample
Signature HijackLoader
Create hunting rule
File size:7'002'440 bytes
First seen:2026-07-19 17:35:33 UTC
Last seen:2026-07-22 11:48:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 20dd26497880c05caed9305b3c8b9109 (31 x Adware.Auslogics, 29 x HijackLoader, 5 x Adware.IObit)
ssdeep 196608:UGgzrZjq9U6aEb2gjOBfwnmWPsCZSSzGT+9xd:cZq9b2gjOdEJvZSSvH
TLSH T11866331AF3CB0476E85099B4492680509D7A38FC4EF9E0066DB1CB5F993E9898F73B47
TrID 72.8% (.EXE) Inno Setup installer (107240/4/30)
9.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win64 Executable (generic) (6522/11/2)
3.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b298acbab2ca7a72 (2'335 x GCleaner, 1'824 x Socks5Systemz, 67 x RedLineStealer)
Reporter Bitsight
Tags:a dropped-by-gcleaner exe HIjackLoader MIX5.file


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
32
# of downloads :
150
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f4bf2c32-2bff-4e53-9251-2b1f26f20261/
Malware family:
n/a
ID:
1
File name:
ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e.exe
Verdict:
Malicious activity
Analysis date:
2026-07-19 17:52:47 UTC
Tags:
delphi inno installer hijackloader stealer snappyclient rat openssl tool
Link:
https://app.any.run/tasks/b8d88db7-f513-41c0-ab52-9ebc1e345666

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75214/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5d0af0bcffb2c48cb79363
Tags:
dropper ramnit crypt virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Launching a service
Creating a file
Deleting a recently created file
Changing a file
Creating a file in the %AppData% subdirectories
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm base64 crypto embarcadero_delphi evasive expired-cert expired-cert explorer fingerprint inno installer installer installer-heuristic lolbin obfuscated packed reconnaissance
Link:
https://www.filescan.io/uploads/6a5d0af01a0060548a406a37/reports/35cd65e6-e3c2-4de4-b23a-a0dc12d95ce2/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-19T14:51:00Z UTC
Last seen:
2026-07-21T01:23:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Penguish.hvb Trojan.Win32.Penguish.sb Trojan.Win32.Delf.sb
Link:
https://opentip.kaspersky.com/ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e/results?tab=lookup
Malware family:
Penguish
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1b25d84-9ac2-47f7-bc31-c6c22e1494e3
Score:
21%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/5a4ae18dd9b4e014f373e3496b4847b4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-19 17:36:29 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pairxynvezhpqjkaafoucx7lkqyike7y7ts73r4n7qyd3afy6ha._file
Verdict:
malicious
Label(s):
TinyUtility
Create hunting rule
Link:
https://reports.threatray.com/b86af5a9-56ee-4770-8e14-d6f96b412e17
Similar samples:
108d5bc2024134624ebfd2f221e636e9d2fd8e4505fa1817387e543cddc76d58
HijackLoader
34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
HijackLoader
4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc
HijackLoader
6dcba233968441cbb50e14bace526d0a22e0947b392973332d94166a9a064a1a
HijackLoader
70864f2938b3640fdb2693298f63ebaa72f404d69b299c799a4d736b7e510cd5
HijackLoader
72344facd02bea9007c59c2a67bd96d521838b566298caf0f80c6ceecf93520f
HijackLoader
957c3fc02297170cea63f95c640c63954774ed5b25be4bb9f40f14b9aba1e06b
HijackLoader
c88a5bba3b32d6c4cfe3c2d33ea8eb5ada10314a8e049ce02d5cda94abd5aeb8
HijackLoader
ef407166a527f6f6d1584c25647bbb14b21320fdd89528ed5f517456eb12bba5
HijackLoader
fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120
HijackLoader
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access discovery installer loader spyware stealer
Link:
https://tria.ge/reports/260719-v6bhfafz6m/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Unpacked files
SH256 hash:
ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e
MD5 hash:
5a4ae18dd9b4e014f373e3496b4847b4
SHA1 hash:
5e265395ad38c8cfd39a99ef878c7511e16d57f8
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
f9569889d5148183abf5ebb8188cc80819ade209efa68558a095dee6c1e2b5fa
MD5 hash:
4a26248e3be5e70727d0c1e01665e0b1
SHA1 hash:
1405a4fea532acadd0da49690c42ed4e06988cd8
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
6cac0849afae6026de400136025686d3472b89538a04f9637658a055d6c17dd2
MD5 hash:
1a068a2c93046c7cec710bb6a7ffac50
SHA1 hash:
410925fbc84916460b74aa82de4f948a18ab3142
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
35a50006d4407c87318aefdb2eaaeaa0dced97f8dbbd9ebcf57262b3f1762033
MD5 hash:
2aef688d5e5db4e501b39769cf23c486
SHA1 hash:
50eb45811ac349a4e12848716cf01458543e347a
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
aae854138694a4a7f65442c9db44203674d63dcbe4c1147ccf31ea83bf411ede
MD5 hash:
072d1a726230135bc67899a07113b3a8
SHA1 hash:
600226e865a88ca3465d79cd0ac91b006e05c1cd
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
321e6a6838bc1ba25017bd419dee078be0803bd3a300c46ca1741994d779d719
MD5 hash:
56106ddde4b09461163b2e4a9c12fef9
SHA1 hash:
bb1266c0e2b673041c7d829a3d7a89c7ba9b7dfa
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
8f0beb5863d190b7b2cfe7f506f3b721ab6b9e892337a133364f2ba710931b25
MD5 hash:
be3cc5717f5951662adb399d613f20cc
SHA1 hash:
f776bc4344ad59fbd6950d24d3aa6dddb3df215a
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
08a93ad91061aeda02121ae6a4fc9ec024f612e39626c615fd5f3765957608a4
MD5 hash:
2e259afb699d02eecfa0817e791e3324
SHA1 hash:
3873b36b6b1257dfa6543124383e932d553126a4
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
SH256 hash:
d0e097820ae6a1946e25640b866d809e253c7e317d240357f8da496201d181cb
MD5 hash:
6ab1efcdf580bedc142703bf4e6bd1f1
SHA1 hash:
f89c90cb13f3c0a0796e9d44107f6aefea55f56f
Link:
https://www.unpac.me/results/3e2b8748-3869-4fcf-ac2d-f218fe634296/
Malware family:
SHADOWLADDER
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ebc088df0da9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HijackLoader

Executable exe ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75214/

Comments