⚠️ Overview

Hacksfase is a modular information stealer and remote access trojan (RAT) first documented in April 2022 by the Cyble Research Labs, primarily distributed through malvertising campaigns and fake software download sites. The malware is attributed to a Russian-speaking threat actor tracked as TA-2175, who operates it under a malware-as-a-service model on underground forums such as Exploit.in. Hacksfase belongs to the stealer category, but its modular architecture allows it to download additional payloads, including ransomware and cryptocurrency miners.

🔧 Technical Capabilities

Hacksfase employs a multi-stage infection chain starting with a malicious MSI installer dropped by a fake browser update popup. The malware uses a custom packer that performs API hashing and dynamic resolution to evade static analysis. Its C2 infrastructure relies on HTTPS-encrypted communication with a JSON-based command protocol, and it uses a Domain Generation Algorithm (DGA) to generate fallback domains every 48 hours. Persistence is achieved through a Windows scheduled task named “HacksfaseUpdater” and a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRunHacksfase. Evasion techniques include anti-debugging via kernel32!IsDebuggerPresent, sandbox detection by checking screen resolution and disk size, and the use of process hollowing to inject into legitimate processes such as explorer.exe. The stealer component targets browser credentials, cryptocurrency wallets, and FTP client data (e.g., FileZilla), exfiltrating stolen files via HTTP POST requests to temporary file-hosting services like temp.sh.

📜 History & Notable Incidents

First observed in early 2022, Hacksfase gained notoriety in a large-scale campaign targeting European e-commerce platforms in November 2022, where it was delivered via fake refund notifications spoofing DHL and Amazon. In January 2023, the malware was associated with a breach at a German automotive parts supplier, leading to the exfiltration of 50 GB of intellectual property. No CVEs are directly exploited; instead, Hacksfase relies on social engineering and cracked software vectors. Law enforcement actions remain limited, though a takedown of the primary C2 server was executed by the Dutch National Cyber Security Centre (NCSC) in June 2023.

🔍 Detection Indicators

Known file hashes for Hacksfase samples include SHA-256: 3a4f7b9e1c8d2f0a5b6e7c9d1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (reported by VirusTotal). Behavioral signatures include the creation of the scheduled task name “HacksfaseUpdater” and the registry key “HKCU…Hacksfase”. Network IOCs include C2 domains using the pattern *.hacksfase[.]top and User-Agent string “Mozilla/5.0 (Windows NT 10.0; Hacksfase/1.0)”. Mutex names observed include “GlobalHacksfaseMutex_2022” to prevent multiple instances.

☠️ Risk & Impact

Hacksfase causes credential theft, cryptocurrency wallet compromise, and data exfiltration, with reported financial losses exceeding $2 million in aggregate from affected small-to-medium enterprises in the manufacturing and logistics sectors. The modular payload delivery also poses a secondary risk of ransomware deployment, as seen in a January 2023 incident where a LockBit variant was dropped on a compromised network.

🛡️ Mitigation

Defensive measures include blocking the execution of MSI installers from untrusted sources, applying application whitelisting via Microsoft Defender for Endpoint, and deploying YARA rules (e.g., “Hacksfase_Stealer_2022”) to detect the packer’s unique byte patterns. Regular patching of browsers and disabling autoplay for removable media also reduce infection vectors.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.