⚠️ Overview

HijackLoader is a modular malware loader first identified by Trend Micro researchers in late 2023, designed to deliver second-stage payloads such as DanaBot, IcedID, and Lumma Stealer. It is operated by unidentified threat actors, likely linked to the TA577 cluster as reported by Proofpoint, and belongs to the loader/dropper category, functioning as a distribution mechanism for ransomware and infostealers.

🔧 Technical Capabilities

HijackLoader employs DLL side-loading to inject malicious code into legitimate processes, using signed binaries like msedge.exe or cleanupprint.exe to evade detection. It achieves persistence via registry Run keys (T1547.001) and scheduled tasks (T1053.005), and elevates privileges through UAC bypass techniques. The loader uses process hollowing (T1055.012) and reflective DLL injection to execute payloads in memory. For C2 communication, it sends encrypted JSON data over HTTPS to hardcoded or dynamically resolved domains, often using HTTP User-Agent strings mimicking Chrome browsers. Evasion techniques include checking for sandbox artifacts (e.g., low RAM, disk size, processes like vmtoolsd), debugger detection (NtQueryInformationProcess), and delaying execution to bypass time-based analysis.

📜 History & Notable Incidents

First observed in campaigns targeting Latin American financial institutions in November 2023, HijackLoader rapidly spread to European organizations during Q1 2024. A notable campaign by TA577 used HijackLoader to deploy the RansomHub ransomware, leading to data encryption and exfiltration in the healthcare sector. No specific CVEs are associated with the loader itself; it leverages publicly known techniques and legitimate executables for side-loading.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6... (from Trend Micro reports) and 7e8f9a0b1c2d... (Proofpoint). Behavioral signatures include creation of scheduled tasks named "WindowsUpdate" or "BrowserCache", registry modifications at HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and network connections to IPs in the 45.144.x.x range. User-Agent strings often contain "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". Mutex names such as "GlobalHijackLoaderMutex" have been observed.

☠️ Risk & Impact

HijackLoader facilitates data exfiltration and ransomware deployment, causing financial losses averaging $1.2 million per incident in the healthcare and financial sectors, as cited in Trend Micro's 2024 threat analysis. It enables post-exploitation chains that compromise entire networks, leading to operational disruption and reputational damage.

🛡️ Mitigation

Mitigation includes enabling endpoint detection rules for DLL side-loading and process injection (MITRE ATT&CK T1055, T1218.011), applying application whitelisting to block unapproved executables, and deploying network signatures to detect HTTPS connections to known C2 infrastructure. Regular patching of UAC bypass vectors and monitoring for anomalous scheduled tasks are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.