Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version

A more recent variation of a malware loader termed Hijack Loader has been observed incorporating an updated set of anti-examination procedures to fly beneath the radar.

“These enhancements aim to raise the malware’s stealthiness, thereby remaining undetected for for a longer period periods of time,” Zscaler ThreatLabz researcher Muhammed Irfan V A stated in a specialized report.

“Hijack Loader now involves modules to incorporate an exclusion for Windows Defender Antivirus, bypass Consumer Account Management (UAC), evade inline API hooking that is typically made use of by security computer software for detection, and use process hollowing.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Hijack Loader, also named IDAT Loader, is a malware loader that was 1st documented by the cybersecurity corporation in September 2023. In the intervening months, the device has been made use of as a conduit to produce many malware households.

This consists of Amadey, Lumma Stealer (aka LummaC2), Meta Stealer, Racoon Stealer V2, Remcos RAT, and Rhadamanthys.

What tends to make the most current edition notable is the truth that it decrypts and parses a PNG graphic to load the upcoming-stage payload, a system that was very first in depth by Morphisec in relationship with a marketing campaign targeting Ukrainian entities based mostly in Finland.

The loader, for each Zscaler, comes equipped with a initial-stage, which is liable for extracting and launching the second-stage from a PNG image which is both embedded into it or downloaded individually dependent on the malware’s configuration.

“The major intent of the 2nd phase is to inject the key instrumentation module,” Irfan described. “To improve stealthiness, the 2nd stage of the loader employs more anti-investigation methods making use of a number of modules.”

Hijack Loader artifacts detected in the wild in March and April 2024 also include as lots of as 7 new modules to support create new procedures, carry out UAC bypass, and increase a Windows Defender Antivirus exclusion by means of a PowerShell command.

Introducing to the malware’s stealth is its use of the Heaven’s Gate approach to circumvent user manner hooks, as earlier disclosed by CrowdStrike in February 2024.

“Amadey has been the most normally shipped household by HijackLoader,” Irfan stated. “The loading of the 2nd stage will involve the use of an embedded PNG graphic or PNG graphic downloaded from the web. On top of that, new modules have been integrated into HijackLoader, boosting its capabilities and building it even much more robust.”

The development will come amid malware strategies distributing unique malware loader people like DarkGate, FakeBat (aka EugenLoader), GuLoader by using malvertising and phishing attacks.

It also follows the emergence of an data stealer identified as TesseractStealer that is distributed by ViperSoftX and utilizes the open up-source Tesseract optical character recognition (OCR) motor to extract text from graphic documents.

“The malware focuses on certain facts relevant to credentials and cryptocurrency wallet information,” Broadcom-owned Symantec claimed. “Next to TesseractStealer, some of the new ViperSoftX operates have also been noticed to fall yet another payload from the Quasar RAT malware relatives.”

Observed this post fascinating? Observe us on Twitter  and LinkedIn to browse much more distinctive written content we article.