Loading malware…
HijackLoader is a modular Windows malware loader and packer used to stage and deploy a wide range of follow-on payloads, especially information stealers and remote-access malware. It has been observed in multiple delivery ecosystems, including ClickFix social-engineering chains, fake software and pirated-software lures, malicious game or installer packages, and DLL side-loading abuse involving legitimate signed applications. Security reporting also refers to related variants or naming overlaps such as IDAT Loader and GHOSTPULSE in some detections and clustering.
The malware is designed for flexible payload delivery and strong defense evasion. Observed samples use DLL hijacking or side-loading, module stomping, process injection, thread-context hijacking, transacted hollowing, syscall indirection, stack spoofing, API hashing, and unhooking of ntdll to reduce visibility to security tools. HijackLoader commonly decrypts staged configuration and payload data from auxiliary files, reconstructs modules in memory, and executes later stages without relying on straightforward on-disk payload placement. Some variants use SEC_IMAGE section mapping and other stealth-oriented injection approaches associated with modern loader tradecraft.
HijackLoader supports persistence and post-compromise orchestration. Reported samples have copied themselves to persistent locations, relaunched via legitimate binaries, created startup shortcuts or scheduled tasks, and altered execution paths depending on the presence of security products. Anti-analysis features documented across samples include virtualization and sandbox checks, timing checks, hardware and memory profiling, locale or regional filtering, hostname inspection, and conditional execution logic driven by configuration modules.
The loader is frequently used as an initial execution platform for other malware families rather than as the final objective itself. Public reporting has linked HijackLoader delivery chains to payloads including Lumma Stealer, Vidar Stealer, DeerStealer, StealC, Amadey, XMRig, Remcos, xWorm, DanaBot, Rhadamanthys, Tofsee, and other stealers or RATs. It has also been observed in campaigns associated with APT-C-36 and in broader criminal distribution operations using cracked software, fake CAPTCHA or verification prompts, and trojanized installers.
HijackLoader primarily targets Windows systems and is notable for combining loader-as-a-service-style flexibility with layered evasion, modular staging, and abuse of trusted binaries to deliver secondary malware at scale.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT-C-36 has used side-loading to execute the HijackLoader payload.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The infrastructure graph generated from the correlation of indicators identified in the campaign reveals a complex network of relationships... through this, we note similarities with the already well-known “HijackLoader.”
“...EncryptHub added to the game files the HijackLoader malware (CVKRUTNP.exe), which establishes persistence on the victim device and downloads the Vidar infostealer (v9d9d.exe).”
30 distinct techniques documented for this family, organized by ATT&CK tactic.
This blob contained a second PowerShell script, decoded and immediately invoked... The third and final script is responsible for downloading and executing the MSI installer.
The contents of the decrypted/deobfuscated PowerShell can be seen below, showing how the LOLBin curl.exe is used to download the HijackLoader dropper MSI and execute it via msiexec.exe.
The focus here is on what the orchestrator actually does, how it routes every syscall through an indirect call chain with full stack spoofing... From this point on, every syscall the orchestrator makes is routed through this mechanism.
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
The site... asked me to click it to prove I was human... instructions: press Win + R, then Ctrl + V, and finally Enter.
These include multi-stage infection chains involving heavily obfuscated and trojanized .NET DLLs; abuse of MSBuild, .csproj, and .bat files to execute them.
В данной статье мы рассмотрим более продвинутый подход к инжекту - в его основе лежит вполне легальный механизм проецирования секций памяти "Mapping"...
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
With the payload mapped into the target process, execution needs to be diverted to it. This is done by modifying the context registers of a thread in the target process.
The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state
The final payload is not fetched from the network, nor is it dropped to disk in a separate file. Instead, it is embedded inside the config blob, appended past the module table.
APIs are resolved dynamically by enumerating the exports of kernel32 and comparing each export name to pre-computed hashes.
The ad used a Google-themed verification prompt... presented what appeared to be a standard Google reCAPTCHA... storagesvc42.bak is not a standard file format. It mimics PNG’s IDAT chunk structure as a container for the encrypted payload.
В данной статье мы рассмотрим более продвинутый подход к инжекту - в его основе лежит вполне легальный механизм проецирования секций памяти "Mapping"...
Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
Данный метод незаслуженно остаётся в тени упомянутого выше. В его основе лежит NtMapViewOfSection() из либы Ntdll.dll, которая используется малварью для скрытой инъекции кода в обход EDR. Технику применяют сл.вредоносы - все они мапят свои либы с атрибутом SEC_IMAGE для загрузки пайлоада
With the payload mapped into the target process, execution needs to be diverted to it. This is done by modifying the context registers of a thread in the target process.
The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state
When the orchestrator detects a security product running on the system, it switches from standard injection to a technique known as transacted hollowing, or more commonly Process Doppelgänging.
# Запуск и мгновенный выход Start-Process powershell -WindowStyle Hidden -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `" $tempScript `" " exit
This blob contained a second PowerShell script, decoded and immediately invoked... The function then loads network256.conf from disk and decrypts it... The code then uses RtlDecompressBuffer to decompress it.
Start-Process "msiexec.exe" -ArgumentList "/i `" $filePath `" /qn /norestart" -Wait -WindowStyle Hidden
Execution then enters an anti-analysis routine... checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
bundling a legitimate application alongside two tampered DLLs... malicious code had been stomped directly into the DLL’s legitimate exports.
The MSI installer turned out to be a carefully constructed package, bundling a legitimate application alongside two tampered DLLs. These facilitated the loading of HijackLoader...
Execution then enters an anti-analysis routine... checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
216 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as an alternative payload delivered in some PavinLoader infections, indicating the loader can flexibly deploy different malware.
An additional loader observed as a secondary payload in some PavinLoader infections.
An additional loader observed as a secondary payload in some PavinLoader-related infections.
Referenced as a loader that uses NtMapViewOfSection/section mapping to load payloads more stealthily.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.