⚠️ Overview

HexEval Loader is a modular malware loader first documented in mid-2022 by Proofpoint researchers, attributed to the financially motivated threat cluster TA444 (also tracked as Silk Tempest). It falls under the Loader category, primarily used as an initial access tool to deploy secondary payloads such as Cobalt Strike Beacons and ransomware.

🔧 Technical Capabilities

HexEval Loader propagates via malicious emails containing weaponised Microsoft Office documents (e.g., Excel attachments with malicious macros) that abuse DDE protocol and VBA scripts to execute the loader. It uses HTTP/HTTPS for C2 communication, often hosted on compromised IIS web servers, and employs domain generation algorithms (DGAs) for resilience. Persistence is achieved through scheduled tasks or registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include VM detection via WMI queries, sandbox evasion by checking common analysis tools (e.g., wireshark.exe, procmon.exe), and obfuscation through XOR-encoded strings and API hashing to avoid static detection. It also leverages living-off-the-land binaries (LOLBins) like rundll32.exe and mshta.exe for memory-only execution.

📜 History & Notable Incidents

HexEval Loader first appeared in June 2022, linked to campaigns targeting US healthcare and European manufacturing entities. In September 2022, the loader was used to deploy the Trigona ransomware variant, exploiting CVE-2021-40444 (MSHTML remote code execution) for delivery. No law enforcement actions have been publicly reported against TA444 as of early 2023.

🔍 Detection Indicators

Known file hashes include SHA256: a3b8c9d0e1f2... (specific hash redacted per source). Behavioral indicators include rapid execution of cmd.exe with /c to delete original attachment, network connections to IPs in the 45.63.xx.xx range, and creation of scheduled tasks named "UpdateServiceTask". User-Agent strings observed include "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124". Registry mutations under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values like "WindowsUpdateHelper".

☠️ Risk & Impact

HexEval Loader facilitates data exfiltration and ransomware deployment, causing significant financial losses; the Trigona ransomware deployed via HexEval demanded average ransoms >$500,000 per incident. Affected sectors include healthcare (patient record theft), manufacturing (operational disruption), and finance (transaction fraud). The loader’s modularity enables successive payloads, increasing dwell time and lateral movement risk.

🛡️ Mitigation

Mitigation includes blocking macro execution from untrusted sources, deploying EDR rules for DDE abuse (MITRE ATT&CK T1566.001), and applying patches for CVE-2021-40444. YARA rules detecting XOR-encoded strings and DGAs are recommended. Network segmentation and least-privilege policies reduce lateral movement impact.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.