HijackLoader

This report analyzes the HijackLoader malware family, enumerating its modular components (e.g., ti, rshell, ESLDR, AVDATA), detailing anti-analysis techniques (including Heaven's Gate and AV process blocklists), persistence via BITS jobs and Startup LNKs, XOR-based payload decryption, and multiple sophisticated code-injection methods used to load and execute final payloads.