HijackLoader Updated with New Evasion Techniques

On 6 May 2024, Zscaler researchers reported that the prevalent HijackLoader (also known as IDAT Loader) has been updated with new detection and analysis evasion techniques.

Context and Technical Details

According to Zscaler researchers, “HijackLoader now includes modules to add an exclusion for Windows Defender Antivirus, bypass User Account Control (UAC), evade inline API hooking that is often used by security software for detection, and employ process hollowing.

In addition, HijackLoader’s delivery method involves the use of a PNG image, which is decrypted and parsed to load the next stage of the attack.”

Key takeaways from the report include:

• “HijackLoader is a modular malware loader that is used to deliver second stage payloads including Amadey, Lumma Stealer, Racoon Stealer v2, and Remcos RAT.
• HijackLoader decrypts and parses a PNG image to load the next stage.
• HijackLoader now contains the following new modules: modCreateProcess, modCreateProcess64, WDDATA, modUAC, modUAC64, modWriteFile, and modWriteFile64.
• HijackLoader has additional features like dynamic API resolution, blocklist process checking, and user mode hook evasion using Heaven’s Gate.
• ThreatLabz researchers created a Python script to decrypt and decompress the second stage and extract all HijackLoader modules.”

Community Impact

According to Zscaler researchers, during March and April 2024, “HijackLoader has emerged as a significant threat, delivering multiple malware families such as Amadey, Lumma Stealer, Racoon Stealer v2, and Remcos RAT.” Amadey and Remcos RAT are among the top malware reported by the RH-ISAC member community, as will be shown in the upcoming RH-ISAC Community Insights for the Verizon 2024 Data Breach Investigation Report. Additionally, Lumma Stealer and Racoon Stealer v2 are reported regularly by the community, but not at a prevalence that qualifies them as top threats.

The RH-ISAC intelligence team assesses with a high degree of confidence that HijackLoader presents a moderate threat to organizations in the retail, hospitality, and travel communities because its role in facilitating the delivery of prominent malware seen by the community. As such, organizations are advised to review the analysis script, indicators of compromise (IOCs), and MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs).

Analysis

Zscaler researchers provided a python script for decrypting and decompressing “HijackLoader’s second stage, providing access to all of the modules”

IOCs

Zscaler researchers provided the following IOCs:

Host Indicators

Network Indicators

TTPS

Zscaler researchers provided the following TTPs: