HijackLoader Qt5Core.dll Sideload via Radmin VPN and PNG-IDAT XML Container

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•3

Detects DLL side-loading activities where the legitimate Radmin VPN executable loads an unsigned or malicious Qt5Core.dll from its local directory, or creates anomalous XML files that function as PNG-IDAT steganography containers. This behavior is associated with HijackLoader (IDAT Loader) malware infection chains.