HijackLoader: IDAT containers, modules and spoofed call stacks

Scope, snapshot and evidence boundary

Current module and evasion analysis plus an official older IDAT extractor treated as separate evidence snapshots. The bounded question is: which architecture and behaviour claims does this specific evidence set support, and which remain attributable only to the source?

What is supported — and what is missing

Primary sources, statically inspectable code and runtime observations carry different evidentiary weight. The map keeps those layers separate; missing first-party observation is not replaced by plausibility.

Entry and delivery chain

The older documented path hides encrypted stages in PNG IDAT chunks; newer variants can place data in pixel structures. A carrier image therefore does not prove benign content, but an unusual PNG alone does not establish the loader.

Architecture and data flow

The public extractor reads chunk lengths, reassembles the encrypted second stage, applies an XOR key and decompresses with LZNT1. The loader itself divides work across modules such as ANTIVM, MUTEX, CUSTOMINJECT and persistence modules. Format and module snapshots must be versioned separately.

Original code as architecture evidence

The short excerpt shows only the structure discussed in this chapter. It is not executed and does not contain a complete operational implementation.

41       input_file.seek(resultOffsetNextByte - 4)
42       size = input_file.read(4)
43       size = struct.unpack('>I', size)[0]
44       configDataCheck1 = input_file.read(4)
45       configDataCheck1 = struct.unpack('<I', configDataCheck1)[0]
46       configDataCheck2 = input_file.read(4)
47       configDataCheck2 = struct.unpack('<I', configDataCheck2)[0]
48       configDataCheck3 = input_file.read(4)
49       xorKey = struct.unpack('<I', configDataCheck3)[0]
50       
51      Size1 = input_file.read(4)
52      Size1 = struct.unpack('<I', Size1)[0]
53      print("Total size: "+hex(Size1))
54      currentSize = 0
55      size = size - 0x10
56      with open(r"secondstage.bin", "ab+") as output_file:
57       while Size1 > currentSize + size:
58        idat = input_file.read(4)
59        payload_encrypted = input_file.read(size)
60        output_file.write(payload_encrypted)
61        currentSize = currentSize + size
62        currentSize = currentSize & 0xFFFFFFFF
63        resultOffsetNextByte = findOffset(file, b'\x49\x44\x41\x54', resultOffsetNextByte+1)
64        input_file.seek(resultOffsetNextByte - 4 )
65        size = input_file.read(4)
66        size = struct.unpack('>I', size)[0]
67        size = size & 0xFFFFFFFF 
68        
69       remainingSize = Size1 - currentSize
70       input_file.seek(resultOffsetNextByte)
71       idat = input_file.read(4)
72       payload_encrypted = input_file.read(remainingSize)
73       output_file.write(payload_encrypted)
74       print("[+] Encypted second stage written to disk")
75       
76      with open(r"secondstage.bin", "rb+") as operation_file:
77       payloadSize = Size1
78       decryptPayload(operation_file, xorKey, payloadSize)
79       print("[+] Second stage successfully decrypted")
80
81    with open(r"secondstage.bin", "rb+") as operation_file:
82     readBytes = operation_file.read()
83     decompressedData = lznt1.decompress(readBytes)
84     with open(r"secondstage_decompressed.bin", "wb") as last_file:
85      last_file.write(decompressedData)

Analysis resistance and persistence

ThreatLabz describes Heaven’s-Gate-style transitions, direct x64 syscalls and forged EBP stack frames to obscure the origin of sensitive calls. Anti-VM checks and process blocklists add further friction; none is unique in isolation.

Capabilities, objective and impact

HijackLoader is primarily a delivery and execution platform. Observed follow-on payloads vary, so a loader finding must not automatically inherit properties or attribution from the later payload.

Telemetry plan and evidence chain

Defensible detection links image-container anomalies with LZNT1/XOR reconstruction, module metadata, unusual syscall stacks and new scheduled-task persistence. The model below covers only the persistence branch and requires environmental baselines. A defensible investigation preserves process GUID and full ancestry, user and session, command line, signer and hash state, file and registry changes, DNS/connection destinations and follow-on access to sensitive data in one timeline. Temporal proximity is an evidence parameter, not mere visualization. Missing sensor coverage is marked per stage so that an unseen event is not falsely treated as an event that did not occur.

Detection engineering and countertesting

Defensible detection links image-container anomalies with LZNT1/XOR reconstruction, module metadata, unusual syscall stacks and new scheduled-task persistence. The model below covers only the persistence branch and requires environmental baselines. The following model is deliberately narrow, not engine-validated and must be tested against legitimate administration and software paths.

1title: HijackLoader scheduled-task branch candidate
2status: experimental
3logsource:
4  product: windows
5  category: process_creation
6detection:
7  selection:
8    Image|endswith: '\\schtasks.exe'
9    CommandLine|contains|all:
10      - '/create'
11      - '/sc'
12      - 'onlogon'
13  condition: selection
14falsepositives:
15  - Legitimate administrative or software activity with the same isolated pattern
16level: medium

Alternative hypotheses and negative tests

Before assigning the family, each signal used by the model is tested independently against software deployment, administration tools, installers, browser or backup software and known internal scripts. At least one structural anchor and one temporally consistent behaviour chain must align. The extractor represents the older IDAT path and does not establish decoding of every pixel variant. Without a sample, modules, injection and persistence were not executed. A negative countercheck rejects only the tested hypothesis; it is not a general all-clear.

Attribution and variant risk

The extractor represents the older IDAT path and does not establish decoding of every pixel variant. Without a sample, modules, injection and persistence were not executed.

Final assessment

The review provides a defensible architecture and detection baseline for the named snapshot. It is not proof of current activity, complete variant coverage or a specific operator.

Review limits

• No independent sample, runtime, C2 or campaign verification.
• The extractor represents the older IDAT path and does not establish decoding of every pixel variant. Without a sample, modules, injection and persistence were not executed.
• Defensive models were not validated with a target engine.