Hidcon

Overview

HackTool:Win32/Hidcon (Hidden Console) designates utilities designed specifically to execute command-line tools, batch files, or scripts silently, without displaying a visible command prompt (`cmd.exe`) window to the logged-in user. While there are legitimate administrative uses for such tools, threat actors heavily abuse them to execute malicious PowerShell, VBScript, or batch payloads invisibly during post-exploitation (`T1564.003`).

Understanding Hidcon (Execution Evasion)
To an end-user, the execution is completely invisible—no flashing black boxes. For a SOC analyst, the presence of a Hidcon utility indicates an attacker is actively attempting to evade visual detection while running scripts. It is a 'living off the land' enabler, allowing attackers to use native system tools quietly.

Execution and Evasion Mechanics
Attackers often drop a small utility (like `hstart.exe` or a custom VBScript wrapper) alongside their primary malicious script. Instead of running `powershell.exe -ExecutionPolicy Bypass -File payload.ps1` directly (which might flash a window), they use the Hidcon tool to launch the script in a hidden, background session (`T1059.001`). This ensures the user does not get suspicious and interrupt the execution of the ransomware encryptor or data exfiltration script.

Indicators of Compromise & Impact
The impact depends on the script being executed invisibly. Host-based IoCs are centered around process command-line arguments. EDR solutions will log the execution of the Hidcon wrapper, and more importantly, the arguments passed to it (which reveal the true malicious script). Look for unexpected parent-child relationships where an unknown executable spawns `cmd.exe` or `powershell.exe` with arguments designed to hide the window (e.g., `-WindowStyle Hidden`).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.
• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_HIDCON {
    meta:
        description = "Detects Hidcon (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "hidcon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Hidcon Activity
id: 2174217ac3ccba9c07d08e32d207face
status: experimental
description: Detects generic indicators of the hidcon malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*hidcon*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Analyze EDR logs to determine exactly which script or command the Hidcon tool was instructed to run.
2. If the hidden script was malicious (e.g., a reverse shell or encryptor), isolate the machine immediately.
3. Search the network for the specific script that was executed to identify the scope of the lateral movement.
4. Implement Application Control (AppLocker) to block the execution of known third-party hidden console utilities.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the alert just because the Hidcon tool itself isn't a virus; the script it executed almost certainly is.
2. Avoid relying solely on user reports ('I saw a weird black box') to detect script execution, as Hidcon completely bypasses this.

References & External Analysis

• Search "hidcon" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• W10Tweak
• Folstart
• Cryrar
• Zmem
• Selltim

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/hidcon.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.