Vidar/HijackLoader rundll32 Proxy-Execution of agt.dll via CorsairUtil

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•2

Detects the use of rundll32.exe to execute the 'ExecuteTask' function from a specific DLL (agt.dll) located in C:\ProgramData\CorsairUtil\. This activity is consistent with proxy-execution techniques used by Vidar/HijackLoader variants to execute malicious payloads, often triggered by a dropped loader executable.