Hijackloader

HijackLoader is a rapidly growing malware in the cybercrime community, designed to exploit and damage computer systems. It operates as a modular multi-stage loader with a strong focus on evading detection, making it a potent threat to cybersecurity. The malware infects systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom once inside. The malware's operation involves a series of stages, starting with an executable file, Setup.exe. When executed, this file loads and executes the HijackLoader first stage inside madBasic_.bpl via DLL search-order hijacking. The HijackLoader configuration file, named maidenhair.cfg, contains data that the loader uses to execute the final RemCos payload. This payload subsequently contacts the command-and-control (C2) server at 213.5.130[.]58[:]433. The HijackLoader malware is often contained within ZIP archives, which when executed, load the RemCos malware. The malware was also discovered targeting Ukrainian entities and Finland RemCos RAT, indicating its global reach. Advertised under the guise of a private crypting service, ASMCrypt, HijackLoader poses a significant threat to digital security due to its stealthy nature and multi-stage loading process.