Loading malware…
HijackLoader is a modular Windows malware loader first reported in 2023 that executes secondary payloads while concealing their deployment through extensive defense-evasion techniques. Observed payloads include Lumma Stealer, ACR Stealer, DeerStealer, Vidar Stealer, and the SnappyClient remote-access malware, also tracked as SilabRAT. Its functionality and final payload vary by configuration and campaign.
HijackLoader infection chains commonly abuse legitimate signed applications for DLL side-loading. Staged components decrypt and decompress configuration containers and executable modules, including containers that disguise encrypted data using PNG IDAT-style chunk structures. Its orchestration modules perform hashed API resolution, construct syscall tables, restore clean system-library code to remove user-mode hooks, and use indirect syscalls and call-stack spoofing. Payload execution techniques include module stomping, section mapping, transacted hollowing or process doppelgänging, and thread-context hijacking. Payloads can be decrypted and executed in memory without being written separately to disk. Observed modules additionally support virtualization checks, security-product discovery, system profiling, scheduled-task persistence, UAC bypass, Windows Defender interference, and reverse-shell functionality.
Distribution includes ClickFix fake CAPTCHA and human-verification pages, malicious advertising, and counterfeit or pirated software and game packages. ClickFix chains frequently induce users to run PowerShell commands that retrieve and silently execute Windows Installer packages. HijackLoader has also been delivered by RenEngine/RenPy-based loaders, PavinLoader, and Amadey. ASMCrypt has produced HijackLoader packages, and APT-C-36 has used DLL side-loading to execute it; these associations do not establish a single operator or developer. Deployments span multiple campaigns and regions rather than a single demonstrated industry focus.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT-C-36 has used side-loading to execute the HijackLoader payload.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The infrastructure graph generated from the correlation of indicators identified in the campaign reveals a complex network of relationships... through this, we note similarities with the already well-known “HijackLoader.”
“...EncryptHub added to the game files the HijackLoader malware (CVKRUTNP.exe), which establishes persistence on the victim device and downloads the Vidar infostealer (v9d9d.exe).”
32 distinct techniques documented for this family, organized by ATT&CK tactic.
modTask Scheduled task persistence (32-bit); modTask64 Scheduled task persistence (64-bit).
This blob contained a second PowerShell script, decoded and immediately invoked... The third and final script is responsible for downloading and executing the MSI installer.
“Both the loader and HijackLoader build their syscall table the same way: read ntdll.dll from disk, walk the export directory, keep every export whose name begins with Zw, and pull the service number out of the function body.”
This module is responsible for dynamically loading another DLL from current directory named VSDebugScriptAgent170.dll using LoadLibraryA API.
The site... asked me to click it to prove I was human... instructions: press Win + R, then Ctrl + V, and finally Enter.
These include multi-stage infection chains involving heavily obfuscated and trojanized .NET DLLs; abuse of MSBuild, .csproj, and .bat files to execute them.
« Le bouton copie une commande dans le presse-papiers et guide l’utilisateur vers Win+R → PowerShell → Coller. »
modTask Scheduled task persistence (32-bit); modTask64 Scheduled task persistence (64-bit).
Once the matching module is identified, it loads a system DLL to inject the shellcode.
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
With the payload mapped into the target process, execution needs to be diverted to it. This is done by modifying the context registers of a thread in the target process.
“The loader marks its own image writable, zeroes it and then calls into the function that is responsible for mapping the final payload in its place. From this point on the process is executing out of memory it has just erased.”
RenEngine Loader reads a .key file from disk, decodes its contents using Base64... locates an XOR-encoded archive... HijackLoader decompresses the data using the RtlDecompressBuffer API.
“The same API resolution order” and “a fresh copy of ntdll.dll is mapped from disk and a second batch of functions is resolved from it.”
The ad used a Google-themed verification prompt... presented what appeared to be a standard Google reCAPTCHA... storagesvc42.bak is not a standard file format. It mimics PNG’s IDAT chunk structure as a container for the encrypted payload.
Once the matching module is identified, it loads a system DLL to inject the shellcode.
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
With the payload mapped into the target process, execution needs to be diverted to it. This is done by modifying the context registers of a thread in the target process.
“The loader marks its own image writable, zeroes it and then calls into the function that is responsible for mapping the final payload in its place. From this point on the process is executing out of memory it has just erased.”
The loader then implements process doppelgänging, writing the shellcode extracted from the .tmp files into both ZoneInd.exe and chime.exe.
# Запуск и мгновенный выход Start-Process powershell -WindowStyle Hidden -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `" $tempScript `" " exit
It then extracts the archive's contents and executes a binary... Stomped Evr.dll reads an encrypted file... compressed module data [is] unpacked.
Start-Process "msiexec.exe" -ArgumentList "/i `" $filePath `" /qn /norestart" -Wait -WindowStyle Hidden
Execution then enters an anti-analysis routine... checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
The loader calculates a scoring sum... to identify if the current execution is within a sandbox machine... If this percentage is below 50, the loader proceeds with execution; otherwise, it terminates silently.
bundling a legitimate application alongside two tampered DLLs... malicious code had been stomped directly into the DLL’s legitimate exports.
The MSI installer turned out to be a carefully constructed package, bundling a legitimate application alongside two tampered DLLs. These facilitated the loading of HijackLoader...
RAM... Hard Disk Storage... CPU Cores... Device Serial... Device Model... Device Manufacturer
Execution then enters an anti-analysis routine... checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
229 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader tentatively identified in a fake Claude-themed verification chain. The lure prompts user execution of PowerShell, leading to subsequent loader stages. Attribution is qualified: related sandbox sessions sharing the download host triggered HijackLoader command-and-control detections.
Malware loader linked to fake Claude download campaigns using ClickFix. These campaigns induce users to paste commands into PowerShell and use mshta.exe to retrieve an obfuscated HTA. The content associates HijackLoader with claudedev[.]net but does not identify its subsequent payloads.
A loader mentioned solely as a comparison for its use of module stomping in a separate campaign.
A loader mentioned only as a comparison for DLL/module stomping behavior in a separate campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.