Loading malware…
MintsLoader is a multi-stage malware loader active since at least 2023 and widely observed in campaigns from 2024 onward. It is primarily a Windows-focused delivery platform implemented through JavaScript and PowerShell stages, and is used to fetch and execute follow-on payloads rather than provide extensive standalone post-compromise functionality of its own. Reported second-stage payloads include GhostWeaver, StealC, Vidar, AsyncRAT, and modified BOINC clients, with some campaigns using decoy payloading to frustrate analysis.
The loader is associated with financially motivated intrusion activity and has been linked to operators tracked as TAG-124, LandUpdate808, and UNC4108. It has also been observed in broader criminal delivery ecosystems involving KongTuke and SocGholish, where compromised websites, fake update lures, and ClickFix-style social engineering are used to drive victims into the infection chain. MintsLoader has been seen in phishing campaigns using invoice-themed lures and in spam-driven delivery chains targeting organizations in the United States and Europe, including the energy, industrial, and legal sectors.
Its infection flow commonly begins with a malicious JavaScript or JScript stage that launches obfuscated PowerShell. Subsequent stages retrieve additional code from attacker-controlled infrastructure, often using domain generation algorithms to rotate command-and-control endpoints. MintsLoader employs multiple anti-analysis and defense-evasion measures, including AMSI bypass attempts, virtual-machine and sandbox checks, and host-environment scoring based on WMI-derived system characteristics such as virtualization indicators, GPU properties, and CPU cache information. In some observed operations, these checks are used to withhold the real payload from likely analysis environments and instead return alternate content.
MintsLoader is notable for its role as a stealthy staging mechanism in larger intrusion chains. It has been used to deliver both information stealers and remote-access tooling, and in some ecosystems appears closely integrated with downstream malware such as GhostWeaver. Its operational use across phishing, ClickFix, and fake-update web compromises makes it a flexible commodity loader within the contemporary cybercrime access-and-delivery market.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
KongTuke has also been seen using a wider kit, including WinPython, Node.js, finger.exe, a fake NexShield browser extension, the encrypted GateKeeper .NET payload, and loaders like MintsLoader and D3F@ck Loader.
KongTuke has also been seen using a wider kit, including WinPython, Node.js, finger.exe, a fake NexShield browser extension, the encrypted GateKeeper .NET payload, and loaders like MintsLoader and D3F@ck Loader.
MintsLoader (TAG-124 / LandUpdate808 / UNC4108) Type: Malware Loader - PowerShell-based, multi-stage delivery platform
Another recently observed customer of TA569 is the MintsLoader malware family... UNC4108 utilizes MintsLoader to deploy various payloads...
Before the RAT arrives, a profiler called MintsLoader runs three checks on the target machine... When we submitted the delivery URLs to a sandbox, the server connected but withheld the payload.
Loaders like Latrodectus and MintsLoader, which could deliver additional malware and other payloads
25 distinct techniques documented for this family, organized by ATT&CK tactic.
SocGholish is a JavaScript (JS)-based downloader malware that's distributed via compromised websites by masquerading as deceptive updates for web browsers like Google Chrome or Mozilla Firefox, and other popular software.
MintsLoader primarily delivers malicious RAT or infostealing payloads such as AsyncRAT and Vidar through phishing emails, targeting organizations in Europe (Spain, Italy, Poland, etc.).
The curl command is used again to invoke the request to the C2 and the response from the C2 is invoked again via iex.
Written in JavaScript and PowerShell, MintsLoader operates through a multi-step infection process involving several URLs and domains...
Written in JavaScript and PowerShell, MintsLoader operates through a multi-step infection process involving several URLs and domains...
The MintsLoader infection process begins when the victim clicks a link in a spam email which downloads a JScript file...
The response from the MintsLoader C2 is obfuscated and is more PowerShell that uses Invoke-Expression (iex) again to execute the next stage.
However, whether the malware is on disk or in memory, we’ve observed its code injected into LOLBins, such as msbuild.exe, regasm.exe, or powershell.exe.
Before the script exits, it deletes itself, likely as a measure to make it more difficult for responders to acquire the file for analysis.
HTTP response returns Base64-encoded, XOR-decoded payload. Once decoded and decompressed, heavily obfuscated PowerShell bypasses AMSI
These abuse finger.exe - a legitimate Microsoft-signed binary from the obsolete Finger protocol. It remains on modern Windows, is rarely monitored, and can make outbound network connections. The piped output goes directly to cmd for execution.
MintsLoader features a Domain Generation Algorithm (DGA) with a seed value based on the addition of the current day of the month and a constant, combined with anti-VM techniques to evade sandboxes and malware researchers.
Step 3 - Evasion: WMI Environment Scoring Three WMI checks produce a cumulative score determining whether C2 serves real payload or decoy.
"...executed it in memory..."; "...keeping the entire chain in memory..."; "...runs the returned PowerShell directly in memory." | "A base64-encoded, Gzip-compressed .NET assembly was unpacked in memory and invoked via reflection."; "...loads... using System.Reflection.Assembly::Load ... identifies its Main method and invokes it via reflection..."
The query parameters are built first by getting the computer name via the environment variable ComputerName...
Once active, SocGholish connects to its C2 infrastructure and deploys a variety of second-stage payloads.
Harvested data is exfiltrated to its command and control (C2) server using HTTP POST requests.
A web request is then invoked to download the payload from temp[.]sh... The response is written to the temp directory and is executed.
73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used in the broader KongTuke/Woodgnat toolset as part of flexible malware delivery methods.
A malware loader used by KongTuke to deliver additional payloads.
A commodity loader used to stage follow-on payloads in Woodgnat-linked attack chains.
A commodity loader used in Woodgnat attack chains to stage follow-on payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.