HijackLoader is a modular malware loader first observed in July 2023 that has become a significant threat due to its adaptability and evolving evasion techniques. Designed to deliver secondary payloads like info-stealers and RATs, it employs a unique combination of anti-analysis methods and modular architecture to bypass security tools.
Key Characteristics
• Uses 18+ modules for code injection, anti-analysis, and payload delivery
• Supports flexible execution chains via embedded or downloaded PNG-based payloads
• Implements call stack spoofing to hide API/system call origins (similar to CoffeeLoader)
Evasion Techniques:
• Syscall-based process injection via Heaven’s Gate (64-bit syscalls in 32-bit processes)
• Anti-VM checks to detect sandboxes
• Dynamic delays (up to 40 seconds) when security tools like Avast/AVG are detected
• Process hollowing combined with transacted hollowing for stealthy execution