MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120
SHA3-384 hash: 2627f4e71bacd4fa05054905c60e471eb592349150098b94b54f6728ce9cb2e9fe272baac8f676a288a27bd0f9d7fb1e
SHA1 hash: 2ca3c4d04e1acdf0b4a2dd48c9e60fd0d04692f4
MD5 hash: 0eea4627ea4b2e5bcc11fe07117999cf
humanhash: spring-zebra-yellow-leopard
File name:file
Download: download sample
Signature HijackLoader
Create hunting rule
File size:6'396'336 bytes
First seen:2026-07-15 18:04:35 UTC
Last seen:2026-07-16 17:06:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 20dd26497880c05caed9305b3c8b9109 (31 x Adware.Auslogics, 31 x HijackLoader, 5 x Adware.IObit)
ssdeep 98304:lgJmL8o+qcsF0pSHT/35P/Qwivw0/VU8OnmSzVgIG4hcDzGTkvIs04LxF4d:f8o+hsF0gFP/Qwc5/q3mS5uSSzGT+9yd
TLSH T1ED563357314380B2F492AB3652C680145E37FDA95FF5BC066CB8C14E663EAD58FB3982
TrID 72.8% (.EXE) Inno Setup installer (107240/4/30)
9.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win64 Executable (generic) (6522/11/2)
3.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b298acbab2ca7a72 (2'335 x GCleaner, 1'826 x Socks5Systemz, 67 x RedLineStealer)
Reporter Bitsight
Tags:c dropped-by-gcleaner exe HIjackLoader MIX9.file


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
7
# of downloads :
190
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7457dcd0-fbea-4847-ba13-46d117b98ea6/
Malware family:
amadey
Create hunting rule
ID:
1
File name:
Setup.exe
Verdict:
Malicious activity
Analysis date:
2026-07-16 14:11:08 UTC
Tags:
auto gcleaner loader amadey botnet stealer stealc remus socks5systemz backdoor vidar generic tofsee
Link:
https://app.any.run/tasks/e073fe0b-94e0-4f73-a6c4-60ecfd33830b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74811/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a57cbbf56bd89099b556137
Tags:
injection dropper crypt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
embarcadero_delphi fingerprint inno installer installer installer-heuristic packed reconnaissance
Link:
https://www.filescan.io/uploads/6a57cbc2774cb1d8d195aa4e/reports/1381ea06-2e24-43ed-8ed9-f25598ceb306/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-15T16:04:00Z UTC
Last seen:
2026-07-17T10:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120/results?tab=lookup
Malware family:
Penguish
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80a0a3c1-aae2-487e-9037-f23970ccbe3b
Score:
22%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/0eea4627ea4b2e5bcc11fe07117999cf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-07-15 18:06:01 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7p334alqindrlax35ceakkwqddlvtq6v74s4e7nqpzh44znd2eqa._file
Verdict:
malicious
Label(s):
tinyutility
Create hunting rule
Similar samples:
error
HijackLoader
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access discovery installer loader spyware stealer
Link:
https://tria.ge/reports/260715-wn1kaadz4t/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Unpacked files
SH256 hash:
fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120
MD5 hash:
0eea4627ea4b2e5bcc11fe07117999cf
SHA1 hash:
2ca3c4d04e1acdf0b4a2dd48c9e60fd0d04692f4
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
fa752d1fc59fce49917b870daa258a78184469f1301775edf81ff7a0913eee62
MD5 hash:
7b31fca7bee6004ae9f3bca739cb56e9
SHA1 hash:
0af6c4d8403ec062e7269b41db006bd543b9f71a
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
4849d4ed65fe2215e1176d67a6ec6d43f672f7cd7f7302e00a7d8c88ba329502
MD5 hash:
07e83f514f9afa881894d13ea55c88cc
SHA1 hash:
5624b73c204c00fa09f9a21ddbab2bf9ec0466eb
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
ff11581b0fc1133adad0f3063d07c727a381647c0516b54fa90c0c9d70846a3c
MD5 hash:
9f99b2d63e002ed10d63be4c0fd188bd
SHA1 hash:
6da80f0cf27fb9aee4aca757005c1baf8c1934c5
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
e63f67c8f6a878e5d481202fcc1230259ae843d3211db6a3fdf41746460dee2c
MD5 hash:
b29a9c5cd1a3575a446a22c18a7dee28
SHA1 hash:
8826a7cf40f81670165edfbe8a803a15195e0cbd
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
140122dd1134cd96c7393fc6d5062e14e4331c35fc15338082687d8db62af059
MD5 hash:
0e7b20ba2d7f3f6923d137e3a618b840
SHA1 hash:
a2fbc96899d2b956c69de2103ee24ecb8c1ae53a
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
8f0beb5863d190b7b2cfe7f506f3b721ab6b9e892337a133364f2ba710931b25
MD5 hash:
be3cc5717f5951662adb399d613f20cc
SHA1 hash:
f776bc4344ad59fbd6950d24d3aa6dddb3df215a
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
08a93ad91061aeda02121ae6a4fc9ec024f612e39626c615fd5f3765957608a4
MD5 hash:
2e259afb699d02eecfa0817e791e3324
SHA1 hash:
3873b36b6b1257dfa6543124383e932d553126a4
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
SH256 hash:
52639b47482ddeb6e87b80c97ad1f6e660c83d8d71a8e6d512893d37c0ad3bd5
MD5 hash:
e137596cdccb7aada7f73aca4d0d6c34
SHA1 hash:
d10393e7528b8c330fad50774ed14b01a2d06a3e
Link:
https://www.unpac.me/results/460cc4df-5647-42e1-8089-ee1e7756c360/
Malware family:
SHADOWLADDER
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fbf7be017043/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HijackLoader

Executable exe fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/74811/

Comments