Loading malware…
HijackLoader, also known as IDAT Loader and sometimes tracked alongside GHOSTPULSE, is a modular Windows malware loader used to stage and execute additional payloads in memory while evading userland security controls. First publicly reported in 2023, it has become a common intermediary in criminal intrusion chains and malware-as-a-service ecosystems, frequently delivering information stealers such as Lumma, Vidar, StealC, DeerStealer, and other follow-on malware, as well as occasionally facilitating deployment of remote-access tooling and legacy banking malware such as Carbanak derivatives.
The loader is notable for its flexible module-based architecture, with orchestrator components such as ti or ti64 coordinating decryption, API resolution, anti-analysis logic, persistence, and payload execution. Observed samples resolve APIs and syscalls through hashing rather than cleartext names, map clean copies of ntdll from disk, and restore or bypass hooked code to reduce EDR visibility. Advanced variants use indirect syscall dispatch, stack spoofing, and TinyCallProxy-style trampolines to make sensitive calls appear to originate from trusted module memory. Payload staging commonly relies on encrypted configuration blobs and steganographic or disguised containers, with final payloads decrypted only in memory.
HijackLoader is strongly associated with DLL side-loading and abuse of legitimate signed applications. Campaigns have used trojanized or tampered DLLs loaded by benign software to start execution, followed by module stomping, process hollowing, transacted hollowing, thread-context hijacking, and other injection paths to transfer execution into trusted or suspended processes. Some samples choose between module stomping and transacted hollowing depending on whether security products are detected. The malware has also been observed copying itself to persistent locations, relaunching from those locations, creating startup shortcuts or scheduled-task persistence in some configurations, and attempting to weaken defenses through security-product discovery or Windows Defender exclusion abuse.
Distribution is heavily tied to social engineering and malware delivery services. Documented infection vectors include ClickFix paste-and-run lures, fake CAPTCHA or verification pages, phishing pages, malicious MSI installers, trojanized software, cracked or pirated software archives, and secondary delivery by other loaders such as RenPy Loader and Amadey. Operators and packer services have also produced HijackLoader packages that combine signed binaries, sideloaded DLLs, encrypted stage files, and memory-only execution. Targeting is broad and opportunistic across consumer and enterprise victims, though some campaigns have specifically affected sectors such as finance and manufacturing and regions including Latin America, Asia Pacific, and Europe.
HijackLoader is best characterized as a stealth-focused execution and delivery framework rather than a data-theft payload itself. Its operational value lies in reliably establishing execution, evading analysis, and deploying follow-on malware while minimizing forensic artifacts on disk.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT-C-36 has used side-loading to execute the HijackLoader payload.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The infrastructure graph generated from the correlation of indicators identified in the campaign reveals a complex network of relationships... through this, we note similarities with the already well-known “HijackLoader.”
“...EncryptHub added to the game files the HijackLoader malware (CVKRUTNP.exe), which establishes persistence on the victim device and downloads the Vidar infostealer (v9d9d.exe).”
28 distinct techniques documented for this family, organized by ATT&CK tactic.
This blob contained a second PowerShell script, decoded and immediately invoked... The third and final script is responsible for downloading and executing the MSI installer.
The contents of the decrypted/deobfuscated PowerShell can be seen below, showing how the LOLBin curl.exe is used to download the HijackLoader dropper MSI and execute it via msiexec.exe.
The focus here is on what the orchestrator actually does, how it routes every syscall through an indirect call chain with full stack spoofing... From this point on, every syscall the orchestrator makes is routed through this mechanism.
The site... asked me to click it to prove I was human... instructions: press Win + R, then Ctrl + V, and finally Enter.
A legitimate DLL is mapped into the target process as a SEC_IMAGE, and the shellcode is then written over its executable section. | If no security products are detected on the system, the orchestrator proceeds with an injection technique known as module stomping. A legitimate DLL is mapped into the target process as a SEC_IMAGE, and the shellcode is then written over its executable section.
used in the process of reading/decrypting the next stage and module stomping the legitimate binary vssapi.dll... The purpose of the next stage is to module stomp the legitimate binary input.dll with core HijackLoader shellcode... Finally, the legitimate binary d3d9.dll is module stomped with shellcode
With the payload mapped into the target process, execution needs to be diverted to it. This is done by modifying the context registers of a thread in the target process.
The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state
The final payload is not fetched from the network, nor is it dropped to disk in a separate file. Instead, it is embedded inside the config blob, appended past the module table.
APIs are resolved dynamically by enumerating the exports of kernel32 and comparing each export name to pre-computed hashes.
The ad used a Google-themed verification prompt... presented what appeared to be a standard Google reCAPTCHA... storagesvc42.bak is not a standard file format. It mimics PNG’s IDAT chunk structure as a container for the encrypted payload.
A legitimate DLL is mapped into the target process as a SEC_IMAGE, and the shellcode is then written over its executable section. | If no security products are detected on the system, the orchestrator proceeds with an injection technique known as module stomping. A legitimate DLL is mapped into the target process as a SEC_IMAGE, and the shellcode is then written over its executable section.
used in the process of reading/decrypting the next stage and module stomping the legitimate binary vssapi.dll... The purpose of the next stage is to module stomp the legitimate binary input.dll with core HijackLoader shellcode... Finally, the legitimate binary d3d9.dll is module stomped with shellcode
With the payload mapped into the target process, execution needs to be diverted to it. This is done by modifying the context registers of a thread in the target process.
The inject process (legitimate signed Q-Dir renamed as SecureLoader_test.exe) is then started in a suspended state
When the orchestrator detects a security product running on the system, it switches from standard injection to a technique known as transacted hollowing, or more commonly Process Doppelgänging.
# Запуск и мгновенный выход Start-Process powershell -WindowStyle Hidden -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `" $tempScript `" " exit
This blob contained a second PowerShell script, decoded and immediately invoked... The function then loads network256.conf from disk and decrypts it... The code then uses RtlDecompressBuffer to decompress it.
showing how the LOLBin curl.exe is used to download the HijackLoader dropper MSI and execute it via msiexec.exe.
Start-Process "msiexec.exe" -ArgumentList "/i `" $filePath `" /qn /norestart" -Wait -WindowStyle Hidden
Execution then enters an anti-analysis routine... checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
bundling a legitimate application alongside two tampered DLLs... malicious code had been stomped directly into the DLL’s legitimate exports.
The MSI installer turned out to be a carefully constructed package, bundling a legitimate application alongside two tampered DLLs. These facilitated the loading of HijackLoader...
Execution then enters an anti-analysis routine... checks including RDTSC timing, CPUID vendor fingerprinting, RAM size, CPU count, and hostname inspection.
216 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware loader delivered via crypter-produced packages that abuses signed binaries and DLL sideloading, then stages components in ProgramData and injects code into another process.
An alternative downstream payload observed in some RenPy Loader infections.
A malware loader distributed via ClickFix social-engineering pages that trick users into executing malicious PowerShell commands.
Autre malware distribué par RenPy Loader dans des campagnes distinctes, mentionné à titre de contexte comparatif.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.