HijackLoader Updates

Tags

External References

• https://www.zscaler.com/
• https://otx.alienvault.com/

Description

HijackLoader, also known as IDAT Loader, is a modular malware loader capable of executing multiple payloads. It utilizes a variety of modules for code injection, execution, and evasion techniques. This report analyzes the updated version of HijackLoader, which includes new modules for bypassing Windows Defender Antivirus, User Account Control, inline API hooking, and employing process hollowing. The report delves into the technical details of HijackLoader's delivery method, involving the use of a PNG image for loading the next stage, as well as the various malware families it has been observed distributing, such as Amadey, Lumma Stealer, Racoon Stealer v2, and Remcos RAT.

Date