S1249 HexEval Loader

malwareEnterprise

platformsLinux · macOS · Windows

also known asHexEval Loader

HexEval Loader is a hex-encoded loader that collects host data, decodes follow-on scripts and acts as a downloader for the BeaverTail malware. HexEval Loader was first reported in April 2025. HexEval Loader has previously been leveraged by North Korea-affiliated threat actors identified as Contagious Interview. HexEval Loader has been delivered to victims through code repository sites utilizing typosquatting naming conventions of various npm packages.

techniques used (12)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.013Encrypted/Encoded File
T1033System Owner/User Discovery
T1036.005Match Legitimate Resource Name or Location
T1041Exfiltration Over C2 Channel
T1056.001Keylogging
T1059.007JavaScript
T1071.001Web Protocols
T1082System Information Discovery
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1614System Location Discovery

used by groups (1)

Threat groups associated with this.

G1052Contagious Interview

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan