Security researchers at ANY.RUN have discovered a new version of the Hijack Loader malware, which now includes enhanced anti-evasion techniques. This update marks a significant advancement in the malware’s ability to avoid detection and operate stealthily.
Hijack Loader, also known as IDAT Loader, first emerged in September 2023 and has quickly gained prominence. It is currently the sixth most detected malware on the ANY.RUN Trends Tracker, based on public sandbox submissions.
The latest version of Hijack Loader decrypts and processes a PNG image to load its second-stage payload. This stage features a modular architecture designed to inject the main instrumentation module, making it more versatile and harder to detect.
In March and April 2024, researchers identified seven new modules associated with Hijack Loader, indicating continuous development and increasing complexity.
Detection and analysis of Hijack Loader are facilitated by the ANY.RUN sandbox, which can detect the malware using YARA rules. The platform provides detailed analysis sessions that highlight the malware’s behavior. For example, in a recent analysis, the second-stage payload failed to download because the Command and Control (C2) server was inactive.
This evolution in Hijack Loader’s capabilities underscores the ongoing challenge of detecting and mitigating malware threats. As cyber threats become more sophisticated, the tools and techniques used to combat them must also advance. Security researchers and organizations need to stay vigilant and continually update their defenses to protect against these evolving threats.
ANY.RUN continues to provide essential tools for analyzing suspicious files and links, helping security professionals keep up with the latest malware developments. Signing up for a free ANY.RUN account allows users to start analyzing potential threats immediately, contributing to a more secure digital environment.