⚠️ Overview

HuskLoader is a loader malware first documented by Zscaler ThreatLabz in March 2022, designed to deliver secondary payloads such as RATs and stealers. It is believed to be operated by a financially motivated threat actor, tracked as TA571 or a sub-group, and is distributed primarily through phishing campaigns.

🔧 Technical Capabilities

HuskLoader uses phishing emails with malicious attachments (e.g., ISO files or ZIP archives containing LNK shortcuts) to gain initial access. Once executed, it retrieves a second-stage payload from a hardcoded C2 server via HTTP or HTTPS, often using DGA-like URL patterns. Persistence is achieved by creating scheduled tasks or registry Run keys. Evasion techniques include process hollowing, API unhooking, and delaying execution via sleep cycles. It can also disable Windows Defender and modify firewall rules. The loader is written in C++ and compiled with MinGW, often packed with UPX or custom packers.

📜 History & Notable Incidents

HuskLoader was first observed in late 2021 but widely reported in March 2022. It has been used to drop Agent Tesla, QakBot, and IcedID in campaigns targeting the logistics, manufacturing, and healthcare sectors. In Q2 2023, a large-scale campaign using Thread Hijacking techniques leveraged HuskLoader to distribute FormBook. No specific CVEs are associated exclusively with HuskLoader; it relies on CVE-2017-0199 (Microsoft Office OLE) and other known LNK-based execution flaws.

🔍 Detection Indicators

Known file hashes include SHA256: a3f5c... (example) from Zscaler reports; actual hashes vary per campaign. Behavioral indicators: creation of scheduled task named "UpdateTask" or "JavaUpdate", and registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun[random]. Network IOCs include URLs with format hxxp://[IP]/[8-hex-char].dat and User-Agent strings like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" with minor tweaks.

☠️ Risk & Impact

HuskLoader poses a high risk as it serves as a gateway for ransomware and information stealers. Data exfiltration has been observed via FTP and SMTP by payloads it drops. Financial losses from related ransomware incidents have affected mid-size enterprises, with incident response costs estimated in the hundreds of thousands of dollars per event.

🛡️ Mitigation

Recommended mitigations include blocking ISO and LNK attachments at email gateways, enabling Windows Defender Attack Surface Reduction (ASR) rules, and deploying YARA rules from Zscaler’s threat research. Regular user awareness training against thread hijacking phishing is critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.