Loading malware…
CountLoader is a multi-stage malware loader used to deliver a range of follow-on payloads including information stealers, remote access trojans, and cryptocurrency-focused malware. It has been observed in large-scale campaigns targeting Windows and, in newer variants, macOS. The malware is commonly delivered through fake or cracked software downloads, trojanized installers, HTA-based execution chains, and ClickFix-style social engineering operated through loader services such as DOUBLECUP. CountLoader has also been observed using lures tailored to security researchers and spreading via removable media on Windows.
On Windows, CountLoader frequently abuses trusted system components such as MSHTA, PowerShell, and other legitimate utilities to retrieve and execute staged payloads, often with heavy obfuscation and in-memory execution. Observed variants establish persistence through scheduled tasks and can adapt execution behavior when certain security products are present. On macOS, observed variants establish persistence through LaunchAgents. CountLoader profiles infected hosts by collecting operating system details, antivirus information, domain membership, and other system metadata, and it checks for cryptocurrency wallet applications, browser wallet extensions, and in some reporting Signal Desktop.
CountLoader communicates with command-and-control infrastructure using a custom encoded protocol and has been observed obtaining JWT-based tasking tokens after host registration. Supported tasking includes downloading and executing additional payloads in multiple formats, launching remote HTA or PowerShell content, removing persistence, collecting domain-related information, and propagating through USB or other removable media. Some variants also use modified or masqueraded legitimate binaries to blend malicious execution with trusted processes.
The malware has been linked to campaigns delivering LummaStealer, Amatera, ACR Stealer, DeviceManager, and cryptocurrency clipper payloads. Separate reporting also describes CountLoader deployments with extensive targeting of browser-based cryptocurrency wallets and Active Directory reconnaissance modules, indicating utility beyond simple commodity delivery and potential value for enterprise post-compromise activity. Infection telemetry and sinkholing have shown broad global victimization, with notable activity reported in Asia and elsewhere. CountLoader is best characterized as an actively maintained loader platform with strong emphasis on stealthy staged execution, persistence, reconnaissance, and flexible payload delivery.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CountLoader — previously investigated by BGI — distributes via a filename specifically designed to lure security researchers: source code of carbanak backdoor discovered.exe . | CountLoader's secondary C2 at burning-edge[.]sbs ( 65.21.174[.]205 , Hetzner) has phpMyAdmin exposed at /phpmyadmin/ , MySQL on port 3306, and 120+ CVEs including regreSSHion.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
The loader also verifies whether CrowdStrike Falcon service is active by querying the antivirus list via WMI.
проверяет наличие Signal Desktop и закрепляется в системе через планировщик задач или LaunchAgent.
CountLoader creates persistence using Scheduled Task with name "GoogleTaskSystem136.0.7023.12" + <GUID-like string>.
с помощью findstr или certutil извлекает из изображения скрытый JavaScript, VBScript или PowerShell-код, который запускает дроппер второго этапа.
11 Executes a remote PowerShell payload by downloading and in-memory executing it via Invoke-RestMethod piping to Invoke-Expression.
с помощью findstr или certutil извлекает из изображения скрытый JavaScript, VBScript или PowerShell-код
с помощью findstr или certutil извлекает из изображения скрытый JavaScript, VBScript или PowerShell-код
bitsadmin.exe /transfer "<job>" /download /priority foreground "<url>" "<out>"
Его клиенты проводят ClickFix-атаки, скрывая вредоносный код в PNG-изображениях, которые заранее загружаются в кеш браузера жертвы.
проверяет наличие Signal Desktop и закрепляется в системе через планировщик задач или LaunchAgent.
CountLoader creates persistence using Scheduled Task with name "GoogleTaskSystem136.0.7023.12" + <GUID-like string>.
Для расшифровки финального пейлоада используется публичный IPv4-адрес жертвы: на его основе формируется ключ для кастомного потокового шифра на базе SHA-256 в режиме CTR с XOR.
The campaign deploys an updated CountLoader and the newly identified DeviceManager RAT, which leverage advanced techniques such as Windows binary patching and blockchain-based C2 resolution.
скрывая вредоносный код в PNG-изображениях... хостит картинки со скрытыми при помощи стеганографии пейлоадами
CountLoader establishes persistence through scheduled tasks and can copy, rename, and modify the PE metadata of legitimate Windows utilities, including conhost.exe, powershell.exe, and mshta.exe, to execute commands while masquerading as trusted applications.
clean up persistence mechanisms likely to erase forensic evidence... If a target CIS language is detected, DeviceManager executes a self-deletion routine: it removes its scheduled task, deletes its installation directory via cmd.exe, and terminates process execution.
bitsadmin.exe /transfer "<job>" /download /priority foreground "<url>" "<out>"
Upon execution, MSHTA retrieves and runs an obfuscated variant of the CountLoader v3.2.
Downloads an MSI installer and performs a silent install under the current user context. msiexec.exe /i "<UserProfile>\package.msi" /quiet /qn
Collects and exfiltrates extensive system/domain reconnaissance (computer role, domain/forest data, current user group memberships, Domain Admins members, domain computers).
Он собирает сведения о системе... В остальных случаях троян собирает GUID машины, SID пользователя, имя хоста, версию ОС, а также данные об архитектуре, установленном антивирусе и домене.
Collects and exfiltrates extensive system/domain reconnaissance (computer role, domain/forest data, current user group memberships, Domain Admins members, domain computers).
Collects and exfiltrates extensive system/domain reconnaissance (computer role, domain/forest data, current user group memberships, Domain Admins members, domain computers).
The malware provides operators with persistence, system reconnaissance, command execution, payload delivery, and resilient command and control capabilities.
The script identifies an active C2 by sending POST requests to domains in the format globalsnn{i}-new[.]cc.
Также этот загрузчик способен скачивать и запускать MSI-пакеты, DLL, PowerShell-модули и другие файлы... загрузки новых пейлоадов.
In short, a random six-digit key is generated and used as an XOR key to encode the Base64 representation of the plaintext.
255 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Updated Windows and macOS loader that profiles the system, searches for cryptocurrency wallet applications and browser extensions, checks for Signal Desktop, establishes persistence via Task Scheduler or LaunchAgent, and can download and execute MSI packages, DLLs, PowerShell modules, and other files.
A loader delivered by DOUBLECUP that establishes persistence via scheduled tasks and can copy, rename, and modify PE metadata of legitimate Windows utilities to masquerade as trusted applications while executing commands. It also profiles infected systems, including OS details, antivirus, domain membership, Signal Desktop, cryptocurrency wallets, and browser extensions.
An updated loader deployed by the DOUBLECUP campaign as a follow-on payload.
Windows and macOS loader that establishes persistence, profiles the host, audits browser extensions for cryptocurrency wallets, checks for Signal desktop installation, gathers system metadata, exfiltrates it, and awaits further tasks such as running secondary payloads or downloading and extracting archives.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.