Loading malware…
HijackLoader, also known as IDAT Loader and sometimes tracked as DOILoader, is a modular Windows malware loader used to stage and deploy a wide range of secondary payloads. It is commonly associated with cybercrime delivery chains rather than a single operator and has been observed in campaigns involving ClickFix social engineering, fake software or game downloads, trojanized installers, spearphishing, and DLL sideloading. The malware is designed to provide flexible payload delivery while complicating analysis through layered packing, in-memory assembly, shellcode stages, and container formats that conceal components inside image-like IDAT data.
A defining characteristic of HijackLoader is its use of modular bundles reconstructed at runtime from encoded or steganographic data, often followed by decompression and execution of additional components entirely or largely in memory. Reported chains show it being launched through sideloaded malicious DLLs beside legitimate signed applications, including cases where shellcode decrypts an IDAT-based container and rebuilds a multi-module framework. Observed modules and behaviors indicate support for process creation, payload staging, UAC-related functionality, Windows Defender interference, custom injection, and persistence-related data handling. HijackLoader has also been used as an intermediary to deploy infostealers and remote-access malware such as Vidar, Remcos, SnappyClient, DeerStealer, Lumma Stealer, and Carbanak-related backdoor activity.
The loader is frequently delivered in socially engineered campaigns. Observed vectors include fake CAPTCHA and verification pages that trick users into executing commands manually, fake updates, malicious archives and installers masquerading as legitimate software or licensing tools, cracked software and game-related lures, and targeted phishing attachments. In several campaigns, HijackLoader was deployed through DLL sideloading using legitimate signed binaries as cover, after which it unpacked and launched follow-on malware. Some campaigns used oversized archives and binary bloating to evade static analysis and sandboxing.
HijackLoader is notable for defense evasion. Across observed chains it has used encrypted shellcode, runtime API resolution, steganographic or pseudo-image containers, decompression of hidden bundles, in-memory execution, process hollowing in downstream stages, and anti-analysis measures intended to frustrate static and automated inspection. It is also widely misapplied by security products as a label for packed samples whose true payload is another malware family, reflecting its role as a loader layer rather than the final objective.
HijackLoader primarily targets Windows environments and is prevalent in financially motivated intrusion activity. Victims have included business users and, in some cases, financial institutions. Its operational role is best understood as a flexible malware delivery framework that enables affiliates or operators to swap final payloads across campaigns while reusing the same loader architecture and evasion techniques.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The observed format is consistent with HijackLoader , also tracked as IDATLoader . The IDAT container is therefore not an isolated packer trick. It belongs to a wider modular loader framework that can deploy different components and final payloads depending on its configuration.
The infrastructure graph generated from the correlation of indicators identified in the campaign reveals a complex network of relationships... through this, we note similarities with the already well-known “HijackLoader.”
“...EncryptHub added to the game files the HijackLoader malware (CVKRUTNP.exe), which establishes persistence on the victim device and downloads the Vidar infostealer (v9d9d.exe).”
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Rhadamanthys is an infostealer distributed via malspam and malvertising. Google searches for popular software such as Notion return malicious ads. Threat actors are using decoy websites to trick users into downloading malware.
Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.
a user was tricked into running a malicious PowerShell command
The Blackpoint SOC received alerts for suspicious powershell.exe usage by a user who fell for a ClickFix-style (Win+R) attack.
The module names expose the frameworks modular design... custom injection. The final carved PE is a legitimate copy of HearthstoneDeckTracker.exe. Its placement within the bundle suggests that it may be used as a host process for the loaders CUSTOMINJECT execution path.
This is a standard way to keep recognizable strings like CreateFileW or VirtualProtect out of the binary
The PowerShell command drops and extracts a large archive (exceeding 120 MB) containing multiple files. This is a well-known binary bloating technique designed to evade static analysis and automated sandbox scanning.
the file is a steganographic container, with its contents stored as a stream of PNG image chunks
The first thing it does is resolve the Windows APIs it needs by carrying a small numeric hash for each API name, walking the export table of kernel32.dll at runtime
The larger physicsdesc.map file is approximately 1.36 MB... The file is not a valid image, but enough of the internal PNG chunk structure is retained for the shellcode to parse it.
The module names expose the frameworks modular design... custom injection. The final carved PE is a legitimate copy of HearthstoneDeckTracker.exe. Its placement within the bundle suggests that it may be used as a host process for the loaders CUSTOMINJECT execution path.
Vidar is decrypted in memory and injected, through process hollowing, into a clean, signed third-party application
The trojanized library then reads an innocuous-looking data file, decrypts it, and produces a block of shellcode
a trusted, signed program loads a malicious library from its own directory, so the attacker’s code ends up running inside a process that every reputation and signature check considers benign
157 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Autre malware distribué par RenPy Loader dans des campagnes distinctes, mentionné à titre de contexte comparatif.
A malware payload observed being delivered by RenPy Loader in some campaigns.
A loader observed as an alternative payload delivered by RenPy Loader in some campaigns.
A loader used to deploy additional payloads after initial execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.