X-Force Threat Analysis Report: LATAM baited into the delivery of PureHVNC

Between August and October 2025, IBM X-Force observed several emails targeting likely Colombian, Spanish-speaking individuals with themes relating to the Attorney General’s office of Colombia. The emails entice the user to download an “official document” from the judicial information system, which starts the infection chain of executing a Hijackloader executable that leads to the PureHVNC Remote Access Trojan (RAT).

• Phishing

Between August and October 2025, X-Force observed several emails targeting users likely residing in Colombia with emails imitating the Attorney General’s office of Colombia with official document downloads. The emails aim to use Hijackloader to deliver several payloads, including PureHVNC. Hijackloader itself has not been widely used in campaigns targeting users within Latin America (LATAM), and previously, there were no observable campaigns by X-Force where LATAM users have been targeted to deliver PureHVNC. In 2024, there are details of Hijackloader being used to load RemcosRAT in campaigns targeting CrowdStrike customers, likely from LATAM countries (based on Spanish filenames and instructions). The delivery of PureHVNC RAT is interesting in that X-Force has not previously observed any campaigns where PureHVNC was delivered to Spanish-speaking users. PureHVNC RAT is part of a set of tools sold by PureCoder. The malicious tools are readily for sale on the dark web on underground forums, as well as on Telegram.

Users are presented with an email purporting to be an official correspondence related to the Attorney General’s office of Colombia. The email states that a lawsuit has been filed by a former employee, and is being processed before the labor courts. Attached to the email is an SVG file, which is opened by the victim in Google Drive. In most instances, the document preview is visible and is ready for download by clicking on the download button. In one instance, the victim was presented with a “Couldn’t preview file” and a download button, which opened the file in Google Drive. In any case, while in Google Drive, clicking anywhere on the document will download a ZIP archive file, and the victim is now presented with a “Download Complete” page containing a password such as “KC4SX87”. The ZIP file contains several additional files, one being an executable file for which the user needs the password in order to execute it if clicked. Clicking on the EXE file will initiate the infection chain, whereby Hijackloader is used to deploy several different payloads, including PureHVNC.

• 02 BOLETA FISCAL.exe (javaw.exe) → JLI.dll → MSTH7EN.DLL → Sumhand.zam → Plagkeg.zk → PureHVNC → sofiavergara[.]duckdns[.]org

Malware stage 1: DLL side-loading

Hijackloader uses a technique called DLL side-loading, which abuses the search order Windows uses to locate required libraries to execute a malicious DLL. Hijackloader uses a legitimate javaw.exe file that has been renamed with a judiciary-themed name (02 BOLETA FISCAL.exe). Since one of the dependencies of javaw.exe is JLI.dll, Hijackloader places a modified version of JLI.dll in the same directory. When the renamed javaw.exe is launched, the operating system also loads the malicious DLL from the local directory.

The primary function of the malicious JLI.dll is to load the 2nd stage payload, MSTH7EN.dll. It does this by calling the LoadLibraryW() API, which loads MSTH7EN.dll into the process’s address space. The API call returns the image base address of the newly loaded DLL. This address is then added to a specific offset to calculate the entry point of the malicious code in MSTH7EN.dll.

Malware stage 2: Loading phase

The second-stage payload begins with initialization. To avoid detection, it dynamically loads and resolves all necessary libraries and APIs. Once complete, it verifies that the current working directory matches the Hijackloader’s location, ensuring the third-stage payload can be referenced and loaded properly.

The third-stage payload contains an encrypted malware configuration with the following components:

• Key to decrypt the configuration
• Size of the encrypted configuration
• The encrypted configuration data

Upon decryption, the malware configuration contains information, such as the following:

• The name of the DLL to perform DLL hollowing on
• The size of the shellcode for DLL hollowing
• The offset of the malicious code within the shellcode
• Hashes of process names that, if found, will delay the malware’s execution
• The first four bytes of the shellcode, used for validation
• A search string used to locate the beginning of the shellcode

The shellcode is then loaded into vssapi.dll, which is the DLL specified in the malware’s configuration. This is done by calling VirtualProtect() to change the memory protection of the DLL’s .text section to PAGE_EXECUTE_READWRITE. Finally, the shellcode is copied to this writable address, and the flow of execution is transferred to it.

The shellcode acts as a loader, but first, it hashes running process names in the system and compares them to the values specified in the malware configuration. If a match is found, the malware uses the NtDelayExecution() API to stall its own execution.

Next, it reads the content of Plagkeg.zk. The content of this file is another encrypted malware configuration and HijackLoader’s modules. The data is split into multiple chunks, with the initial chunk containing the following information:

• The size of the encrypted data
• Marker (“IDAT”)
• A value (0xC6A579EA) used for checking the starting bytes of the shellcode
• The key for decrypting the data

The subsequent chunks follow this structure:

• The size of the shellcode chunk
• Marker (“IDAT”)
• The encrypted bytes

To assemble these chunks, HijackLoader iterates through the encrypted data searching for the “????IDAT“ pattern, where the question marks act as wildcards. Once a match is found, it checks if the four bytes immediately following the pattern are equal to 0xC6A579EA. This confirms that the initial chunk has been found, which is important because it contains the total size of the shellcode and the decryption key. If the value matches, HijackLoader stores the shellcode bytes into a buffer. The process is repeated for all subsequent chunks, with their shellcode bytes being appended to the same buffer, until no more matching patterns are found.

Once done, the buffer containing the encrypted shellcode is decrypted using an XOR cipher and then decompressed using the LZNT1 algorithm. The result is a structure that contains various information, such as the final payload, the module structure, etc.

Malware stage 3: ti64 - main module

HijackLoader’s functionality is divided into modules. Some contain executable code, while others are simply information used for reference. An example of this is the COPYLIST module, which contains the list of filenames related to this variant of HijackLoader. As per Trellix’s report, some variants of HijackLoader support up to 40 modules, but the sample analyzed for this report only supports 35. Not all modules are executed, and their use depends on flags specified in the malware configuration.

The table below summarizes the name of each module and its purpose:

HijackLoader loops through these structures and converts each module name to a hash using a custom algorithm. Once the match for the “ti64” module is found, it calculates a pointer to the module’s code by adding the offset of the data to the base of the module data array. This pointer is then returned and used as a reference to shellcode of “ti64”.

Next, the malware performs another DLL hollowing operation to inject the “ti64” module’s shellcode. The target is a DLL specified in the previously decrypted configuration, which in this case is pla.dll.

The modUAC module, similar to the other modules, uses TinycallProxy to call APIs. If the first DWORD of the UACDATA module is 2, it uses the “runas” to elevate its privilege. Otherwise, it uses the CMSTPLUA COM interface to bypass UAC.

In some variants, HijackLoader uses a technique called “stack spoofing“ to mask the origin of API and system calls. It does this by using the base pointer register (EBP) to navigate the stack, following the chain of EBP pointers to retrieve the return address from each stack frame. If a return address is not within the .text section of ntdll.dll or kernelbase.dll, HijackLoader stores it for later. This process is repeated until the stack limit is reached or until three consecutive return addresses are found within those system libraries.

Next, it performs call stack spoofing by overwriting the saved, legitimate return addresses with fake ones. Each fake address is generated by selecting a random export from a DLL specified by the SM module (in this case, dcd9.dll) and adding a random offset, ensuring the final pointer lands within that module’s .text section. Heaven’s Gate is then used to perform the syscall. Immediately after the call completes, the original stack addresses are restored.

More recent variants, however, use a different technique. Instead of stack spoofing, HijackLoader loads the target DLL specified by the SM module via LoadLibraryW(). It then saves the code from a random offset within that DLL to a temporary buffer and replaces it with the TinyCallProxy64 module’s shellcode, which is designed to call the specified API. Once the call is finished, the original, clean code is restored.

HijackLoader uses these techniques for a select number of functions that are likely to be monitored by AV software, such as ZwProtectVirtualMemory and ZwGetContextThread.

A failed anti-virtualization check results in process termination via a call to ZwTerminateProcess().

The unhooking routine compares the .text section of the currently loaded ntdll.dll against a clean, mapped copy. It scans for call (0xE8) and jmp (0xE9) instructions and detects a hook if the instruction type or destination address differs between the two versions. If a hook is found, the malware patches the in-memory ntdll.dll by restoring the original, clean bytes.

HijackLoader’s persistence mechanism is also controlled by its configuration. The behavior is dictated by a flag:

• LNK Shortcut (Flag 1): If the flag is set to 1, the HijackLoader creates an LNK file pointing to its own executable path. This shortcut is then moved into the user’s startup folder to ensure execution on logon.
• Scheduled Task (Flag 3): If the flag is set to 3, it creates a scheduled task using the modTask module.

In addition to these flags, HijackLoader can create another persistence mechanism by checking for a PERSDATA module. This module contains the necessary configuration data, such as the task name, to create a second scheduled task.

Users within LATAM regions are increasingly targets of emails impersonating government or judicial entities, with themes often creating a sense of urgency. X-Force observes campaigns that routinely involve an embedded link or ZIP attachments that lead victims to malicious downloaders. Between August and October 2025, X-Force observed several emails targeting users likely residing in Colombia with emails imitating the Attorney General’s office of Colombia with official document downloads. Hijackloader is a modular malware with evasion and persistence mechanisms, primarily delivered to users as a ZIP or RAR archive file. The archives contain a malicious DLL that is sideloaded and used to deliver additional payloads. These emails, likely a part of a single campaign, are significant in that the actors utilize the Hijackloader to deliver PureHVNC RAT, a combination not previously observed by X-Force.

• Enable the display of file extensions.
• Examine the operational need to allow traffic to and from DuckDNS domains.
• Take caution in opening email attachments and clicking on embedded links from untrusted or unknown sources.
• Hunt for processes, network traffic and IoCs detailed in this report.
• Install, update, and configure endpoint security software.
• Monitor endpoint rules

IBM X-Force Premier Threat Intelligence is now integrated with OpenCTI by Filigran, delivering actionable threat intelligence about this threat activity and more. Access insights on threat actors, malware, and industry risks. Install the X-Force OpenCTI Connector to enhance detection and response, strengthening your cybersecurity with IBM X-Force’s expertise. Get a 30-Day X-Force Premier Threat Intelligence trial today!