Loading malware…
ClaimLoader is a Windows shellcode loader associated with China-aligned espionage activity, most notably operations attributed to Mustang Panda and the related Hive0154 tracking cluster. It is used in DLL sideloading infection chains in which a legitimate signed or renamed executable loads a malicious DLL that decrypts and launches a next-stage payload in memory. ClaimLoader has been used to deliver PUBLOAD and related backdoor tooling, including follow-on reverse-shell capability, in campaigns targeting government, diplomatic, military, policy, and Tibetan-community victims, as well as broader Southeast Asian targets.
The malware’s core role is to act as an in-memory loader. Observed variants decrypt embedded strings, create a mutex, dynamically resolve imports using XOR-obfuscated API names and native loader functions, and decrypt embedded shellcode or payloads for execution. Execution has been observed through callback-based techniques, including abuse of Win32 callback APIs, and the malware has been documented injecting or launching decrypted payloads directly in memory rather than writing the final stage to disk. ClaimLoader has also been described as part of a family of related loader variants used over multiple years, with different samples employing XOR-, AES-, or TripleDES-based decryption routines.
Persistence is a recurring feature. Documented variants move or copy components into system directories, establish autorun through Windows Run keys, and create scheduled tasks, including via schtasks and COM task-scheduler interfaces, to relaunch the loader at regular intervals or at startup. The malware has also used decoy documents and spoofed executables to entice user execution, and campaigns have commonly relied on phishing-delivered archives containing a benign executable vulnerable to DLL sideloading alongside the malicious ClaimLoader DLL.
Operationally, ClaimLoader is closely tied to espionage tradecraft rather than financially motivated intrusion. It has appeared in politically themed lure campaigns involving Tibet-related subjects and in USB-propagated intrusion chains where worm activity spread malicious components laterally across endpoints and used ClaimLoader to decrypt and execute shellcode in memory. Its repeated use alongside PUBLOAD, ToneShell-related tooling, and USB propagation mechanisms makes it a notable component of the broader Mustang Panda and Hive0154 malware ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Details on Exploited Vulnerabilities ... CVE-2021-1675 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve1 = “CVE-2021-1675”
Details on Exploited Vulnerabilities ... CVE-2021-40444 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve2 = “CVE-2021-40444”
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This is the malware’s main function, which, according to the IBM X-Force report, is the Claimloader. Basically, this function performs the following actions: Decrypts Strings; Checks the Passed Argument; Creates a Mutex; Creates Persistence on the Infected System; Executes the Decryption Routine.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The Mustang Panda activity, recorded between June 1 and August 15, 2025, entailed the use of a USB-based malware known as HIUPAN to deliver the PUBLOAD backdoor by means of a rogue DLL codenamed Claimloader.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st
"BOOKWORM ... execution on the heap is initiated through callback function of legitimate API functions such as EnumChildWindows or EnumSystemLanguageGroupsA"; "CLAIMLOADER ... run its shellcode through the callback function"; "PUBLOAD stager leveraged Windows API functions with callback ... to bypass anti-virus monitoring"
VirtualAlloc is an extremely common function for allocating buffers for shellcode... After copying the shellcode to the previously allocated buffer... the offset of this buffer will be used as an argument for the EnumFontsW function call, which, when called, will execute the shellcode by abusing the API’s Callback mechanism.
The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.
Examples include: "Sandworm Team leveraged Microsoft Office attachments which contained malicious macros..."; "Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs"; "Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files."
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
all strings encrypted by this algorithm refer to APIs that will be dynamically loaded to implement specific capabilities, primarily allocation, injection, and execution of the next stage ( Publoader ).
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The string decryption routine is quite simple, essentially an XOR operation on a single-byte key... Another custom string decryption algorithm... The XOR key is composed of a 4-byte array
all strings encrypted by this algorithm refer to APIs that will be dynamically loaded... parse the ntdll.dll module to load the LdrLoadDll API... followed by the decrypted API being loaded via the LdrGetProcedureAddress API.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
all strings encrypted by this algorithm refer to APIs that will be dynamically loaded to implement specific capabilities, primarily allocation, injection, and execution of the next stage ( Publoader ).
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
The malware copies its components to a working directory... These components include: A legitimate parent process ClaimLoader itself
This is the malware’s main function... Basically, this function performs the following actions: Decrypts Strings; Checks the Passed Argument; Creates a Mutex; Creates Persistence on the Infected System
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a comparative loader family with similar callback-API execution style.
A loader used to decrypt and execute shellcode in memory as part of the intrusion chain.
Shellcode loader that copies components to a working directory, establishes persistence via Windows autorun registry keys, decrypts embedded shellcode with XOR, and executes PUBLOAD in memory using the CryptEnumOIDInfo API.
Loader family referenced as part of Mustang Panda’s infection chains to stage additional payloads (specific capabilities not detailed in the content).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.