The Discovery of Hijack Loader Malware through the Application of Stolen Code-Signing Certificates
A brand new malicious scheme has been revealed by cybersecurity investigators wherein Hijack Loader pieces, signed with valid code authentication certificates, are being distributed.
At the beginning of this month, French cybersecurity entity HarfangLab, who came across this operation, mentioned that the attack chains are intended to roll out an information exfiltration tool known as Lumma.
Hijack Loader, also recognized as DOILoader, IDAT Loader, and SHADOWLADDER, was first identified in September 2023. Schemes involving this malicious loader frequently revolve around deceiving users into downloading a corrupted binary file disguised as pirated software or movies.
Recent versions of these campaigns have been discovered to direct users to counterfeit CAPTCHA pages urging site visitors to demonstrate their humanity by copying and executing an encoded PowerShell command to unleash the malicious payload enclosed in a ZIP archive.
HarfangLab noted that starting from mid-September 2024, three versions of the PowerShell script have been observed –
- A PowerShell script employing mshta.exe to execute code residing on a remote server
- A remote-hosted PowerShell script directly executed through the Invoke-Expression cmdlet (i.e., iex)
- A PowerShell script that utilizes msiexec.exe to fetch and execute a payload from a distant URL
Within the ZIP archive, there exists a legitimate executable file that is vulnerable to DLL side-loading, along with the malevolent DLL (i.e., Hijack Loader) designated for loading instead.
“The objective of the sideloaded HijackLoader DLL is to unravel and carry out an encrypted file provided in the bundle,” explained HarfangLab. “This file conceals the ultimate HijackLoader phase, which is engineered to download and execute an exfiltration implant.”
The delivery process has transitioned from DLL side-loading to the utilization of numerous authenticated binaries in early October 2024 in a bid to dodge detection by security tools.
It is presently uncertain whether all the code verification certificates were filched or intentionally generated by the threat actors themselves. Nonetheless, the cybersecurity organization analyzed with mild to moderate confidence that the latter scenario could be feasible. The certificates have been annulled subsequently.
“For various certificate-issuing authorities, it was observed that procuring and activating a code-signing certificate is predominantly automated, requiring solely a valid corporate registration number and a designated contact person,” it expressed. “This investigation illustrates that malware can be sealed with a digital signature, showcasing that a code signature alone cannot be considered a definitive gauge of trustworthiness.”
This development coincides with SonicWall Capture Labs cautioning about a surge in cyber assaults contaminating Windows systems with a malware titled CoreWarrior.
“This is a persistent trojan striving to spread rapidly by spawning numerous duplicates of itself, connecting with multiple IP addresses, setting up multiple sockets for backdoor access, and tapping into Windows UI components for surveillance,” it stated.
Phishing stratagems have also been witnessed delivering a commonplace exfiltration and loader malware referred to as XWorm by utilizing a Windows Script File (WSF) that fetches and executes a PowerShell script hosted on paste[.]ee.
The subsequent action of the PowerShell script is to trigger a Visual Basic Script, which serves as an intermediary to execute an array of batch and PowerShell scripts for loading a malicious DLL tasked with infusing XWorm into a bona fide process (“RegSvcs.exe”).
The most recent iteration of XWorm (version 5.6) includes capabilities like response time reporting, screenshot collection, host file reading and modification, execution of a denial-of-service (DoS) assault on a target, and elimination of stored plugins, suggesting an effort to sidestep creating a forensic trace.
“XWorm is a multidimensional instrument that grants an array of capabilities to the assailant,” conveyed Netskope Threat Labs security researcher Jan Michael Alcantara stated.
About Author
