Hijackloader

HijackLoader is a new and rapidly growing malware in the cybercrime community, designed to exploit and damage computer systems. This malicious software infects systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once infiltrated, HijackLoader can steal personal information, disrupt operations, or hold data hostage for ransom. It operates by invoking malicious Dynamic Link Libraries (DLLs) through sideloading, ultimately executing a version of itself that injects the spy Remote Access Trojan (RAT), such as AsyncRAT. The malware was notably used in a recent campaign that followed the usual tactics, techniques, and procedures (TTPs) of a known cybercriminal group, with the added twist of DLL sideloading. The attack was initiated via phishing emails impersonating Colombia's judicial institutions, containing malicious PDF or DOCX files masquerading as a demand notice or court summons. HijackLoader was also found in a ZIP file targeting Ukrainian entities and Finland, where it loaded the RemCos RAT. The malware uses different capabilities like User Account Control (UAC) bypass, various process injection techniques, and inline Application Programming Interface (API) hooking evasion to remain undetected. HijackLoader, also advertised as a private crypting service ASMCrypt, is a modular multi-stage loader highly focused on evading detection. It uses a configuration file named "maidenhair.cfg" to execute the final RemCos payload, which then contacts the command-and-control (C2) server. Its ability to unpack different stages of the payload and inject them into legitimate processes further enhances its stealth. With its growing popularity among cybercriminals, HijackLoader poses a significant threat to cybersecurity.