Loading malware…
ClaimLoader is a Windows malware family used primarily as a shellcode loader in China-aligned espionage operations, most notably those associated with Mustang Panda, also tracked in some reporting as Hive0154 or Stately Taurus. It is commonly deployed through DLL sideloading chains in which a renamed or legitimately signed executable loads a malicious DLL, often accompanied by decoy documents or document-spoofing executables to entice user execution. Campaigns using ClaimLoader have targeted government, diplomatic, military, policy, and Tibetan-community entities, and it has also appeared in broader Southeast Asian government intrusions and USB-propagated infection chains.
Its core role is to establish execution and persistence, decrypt an embedded or staged payload, and run it in memory. Reported variants decrypt strings, create a mutex, dynamically resolve imports using XOR-obfuscated API names together with native loader functions such as LdrLoadDll and LdrGetProcedureAddress, and execute decrypted shellcode via callback-based techniques. ClaimLoader has been documented establishing persistence through Windows Run keys and scheduled tasks, including creation of tasks through both schtasks and COM interfaces such as ITaskService. It has also been observed modifying file attributes to hide components from users.
ClaimLoader is closely associated with the delivery of PUBLOAD and related payloads, and some reporting describes it as loading PUBLOAD directly in memory, after which downstream malware such as Pubshell or ToneShell may be deployed. In USB-borne operations, related HIUPAN or USBFect activity has used ClaimLoader to decrypt and execute shellcode across multiple endpoints, supporting lateral spread through removable media. Across observed campaigns, ClaimLoader has functioned as a stealth-focused loader and persistence component within long-term espionage tradecraft rather than as a standalone monetization tool.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Details on Exploited Vulnerabilities ... CVE-2021-1675 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve1 = “CVE-2021-1675”
Details on Exploited Vulnerabilities ... CVE-2021-40444 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve2 = “CVE-2021-40444”
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This is the malware’s main function, which, according to the IBM X-Force report, is the Claimloader. Basically, this function performs the following actions: Decrypts Strings; Checks the Passed Argument; Creates a Mutex; Creates Persistence on the Infected System; Executes the Decryption Routine.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The Mustang Panda activity, recorded between June 1 and August 15, 2025, entailed the use of a USB-based malware known as HIUPAN to deliver the PUBLOAD backdoor by means of a rogue DLL codenamed Claimloader.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st
"BOOKWORM ... execution on the heap is initiated through callback function of legitimate API functions such as EnumChildWindows or EnumSystemLanguageGroupsA"; "CLAIMLOADER ... run its shellcode through the callback function"; "PUBLOAD stager leveraged Windows API functions with callback ... to bypass anti-virus monitoring"
VirtualAlloc is an extremely common function for allocating buffers for shellcode... After copying the shellcode to the previously allocated buffer... the offset of this buffer will be used as an argument for the EnumFontsW function call, which, when called, will execute the shellcode by abusing the API’s Callback mechanism.
The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.
Examples include: "Sandworm Team leveraged Microsoft Office attachments which contained malicious macros..."; "Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs"; "Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files."
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
all strings encrypted by this algorithm refer to APIs that will be dynamically loaded to implement specific capabilities, primarily allocation, injection, and execution of the next stage ( Publoader ).
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The string decryption routine is quite simple, essentially an XOR operation on a single-byte key... Another custom string decryption algorithm... The XOR key is composed of a 4-byte array
all strings encrypted by this algorithm refer to APIs that will be dynamically loaded... parse the ntdll.dll module to load the LdrLoadDll API... followed by the decrypted API being loaded via the LdrGetProcedureAddress API.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
all strings encrypted by this algorithm refer to APIs that will be dynamically loaded to implement specific capabilities, primarily allocation, injection, and execution of the next stage ( Publoader ).
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
The malware copies its components to a working directory... These components include: A legitimate parent process ClaimLoader itself
This is the malware’s main function... Basically, this function performs the following actions: Decrypts Strings; Checks the Passed Argument; Creates a Mutex; Creates Persistence on the Infected System
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a comparative loader family with similar callback-API execution style.
A loader used to decrypt and execute shellcode in memory as part of the intrusion chain.
Shellcode loader that copies components to a working directory, establishes persistence via Windows autorun registry keys, decrypts embedded shellcode with XOR, and executes PUBLOAD in memory using the CryptEnumOIDInfo API.
Loader family referenced as part of Mustang Panda’s infection chains to stage additional payloads (specific capabilities not detailed in the content).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.