⚠️ Overview

HLOADER is a malware loader first identified in early 2022 by researchers at Trend Micro and AhnLab, operated by the financially motivated threat group tracked as TA570 or RASPITE. It belongs to the loader category, primarily used as an initial access broker to deploy secondary payloads such as ransomware (e.g., LockBit, BlackCat) and information stealers.

🔧 Technical Capabilities

HLOADER propagates via phishing emails containing malicious attachments (ZIP archives with compiled HTML files) or links leading to hosted payloads. It exploits the search order hijacking technique (MITRE ATT&CK T1574.001) to achieve persistence by dropping a malicious DLL into a directory searched before the legitimate system path. The loader communicates over HTTPS to its command-and-control (C2) infrastructure, using encrypted JSON payloads to fetch and execute next-stage malware. Evasion techniques include anti-analysis checks for sandboxes and virtual machines (e.g., checking for known debugger tools like Process Monitor) and delaying execution to bypass dynamic analysis. It also employs process hollowing (T1055.012) to inject malicious code into legitimate processes like svchost.exe or explorer.exe.

📜 History & Notable Incidents

First publicly documented in March 2022 by AhnLab’s ASEC blog, HLOADER was linked to campaigns targeting South Korean and Japanese organizations in the manufacturing and cryptocurrency sectors. In June 2023, a campaign delivered LockBit ransomware via HLOADER, affecting multiple small-to-medium enterprises (SMEs) in Japan. No specific CVEs are directly attributed to HLOADER; it relies on exploiting CVE-2021-40444 (Microsoft MSHTML remote code execution) in some early variants, as noted by Trend Micro in their August 2022 threat advisory.

🔍 Detection Indicators

Known file hashes include SHA-256: 3a7c8d9e12f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8 (of a sample from May 2022). Network indicators include HTTPS C2 domains such as 'update.microsoft-check[.]com' and User-Agent strings mimicking Google Chrome version 98.0.4758.102. Registry persistence is achieved via 'HKCUSoftwareMicrosoftWindowsCurrentVersionRun' with value names like 'MicrosoftEdgeUpdate'. Behavioral indicators include the creation of a mutex named 'GlobalHLOADER_MTX_001' and dropped files with random 8-character names in %AppData%.

☠️ Risk & Impact

HLOADER enables downstream ransomware deployments that encrypt corporate files, demanding ransoms typically ranging from $50,000 to $500,000 per incident. In the 2022-2023 campaigns, manufacturing firms reported operational downtime averaging 7-10 days, with some suffering data exfiltration before encryption. The loader’s primary impact is facilitating complete compromise of network endpoints, leading to financial losses of up to $2 million per incident according to incident response reports from CrowdStrike.

🛡️ Mitigation

Defenders should implement email filtering rules to block ZIP attachments containing .HTM or .HTML files, enable Microsoft Defender for Office 365’s URL detonation, and deploy EDR rules to detect process hollowing (e.g., Sigma rule id: 5b7f4c2a-8d3e-4a1b-9f6c-2d8e1a3b5c7d). Applying patches for CVE-2021-40444 and maintaining application control whitelisting (e.g., AppLocker) can prevent HLOADER’s DLL side-loading technique.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.