Menace Actors Use Pirated Video games to Bypass Microsoft Defender SmartScreen and Adblockers

Cybersecurity researchers have uncovered a classy marketing campaign the place risk actors leverage pirated recreation downloads to distribute HijackLoader, a modular malware loader, successfully bypassing widespread defenses like adblockers and Microsoft Defender SmartScreen.

Websites similar to Dodi Repacks, usually deemed “secure” on piracy boards when used with instruments like uBlock Origin, function vectors for this malware.

Customers trying to obtain cracked video games are redirected by domains like zovo[.]ink and downf[.]lol to MEGA-hosted ZIP archives containing nested .7z information.

These archives disguise malicious payloads inside seemingly respectable information, similar to outsized DLLs like DivXDownloadManager.dll, which exceed sandbox add limits to evade automated evaluation.

Malware Distribution By way of Piracy Networks

Regardless of adblockers, the an infection chain proceeds, debunking claims that such instruments present enough safety.

Evaluation reveals that the malware employs module stomping on system DLLs like shell32.dll, decrypting configurations from information like quintillionth.ppt and paraffin.html utilizing SIMD-accelerated XOR loops and LZNT1 decompression.

This setup masses subsequent phases, together with anti-VM checks for hypervisors, RAM thresholds, and course of counts, making certain execution solely on appropriate sufferer machines.

HijackLoader’s modular structure helps as much as 40 parts, with the “ti” module dealing with API decision through CRC32 hashes, stack spoofing by Heaven’s Gate syscalls, and unhooking of ntdll.dll and wow64cpu.dll to evade EDR instruments.

It disables WOW64 redirection, spoofs return addresses utilizing random exports from DLLs like shdocvw.dll, and performs time-based anti-debugging through RDTSC and CPUID differentials.

Payload Deployment

Persistence is achieved by LNK information in startup folders, scheduled duties through modTask, or BITS transfers, with self-elevation utilizing modUAC exploiting runas or CMSTPLUA.

Injection targets respectable executables like selection.exe or signed binaries similar to XPFix.exe from Qihoo 360, using course of hollowing with out CREATE_SUSPENDED flags by piping enter to renew threads.

For AV evasion, it detects merchandise like Avast, AVG, and Kaspersky through course of hashes, disables Home windows Defender exclusions through elevated PowerShell instructions, and deploys payloads like LummaC2 stealer.

Remaining injection entails decrypting payloads with XOR keys, resolving relocations, and executing through modules like rshell or ESAL, usually mapping transacted sections with tinystub PE information rolled again post-injection.

This marketing campaign extends past gaming websites, infiltrating platforms like TIDAL playlists linking to malicious archives on up-community[.]web and weeklyuploads[.]click on, highlighting widespread abuse of cracked software program searches on Google.

Energetic growth in modules like ti and rshell underscores HijackLoader’s evolution, beforehand linked to households together with Remcos, Vidar, and Redline Stealer.

Indicators of Compromise (IOCs)

AWS Safety Companies: 10-Level Govt Guidelines - Obtain for Free