Loading malware…
HUI Loader is a custom Windows malware loader associated with multiple China-nexus intrusion sets and espionage operations, and has also appeared in incidents linked to ransomware deployment. It is commonly used as an intermediate execution component that side-loads through legitimate applications vulnerable to DLL search order hijacking, decrypts or stages an encrypted payload blob, and launches follow-on malware in memory. Reported payloads include Cobalt Strike Beacon and SodaMaster, and the loader has been observed injecting payloads into trusted Windows processes such as mstsc.exe and svchost.exe.
A characteristic deployment pattern uses a three-part chain consisting of a legitimate executable, a malicious DLL loader, and an encrypted data blob. Variants have been distributed alongside legitimate software components from products such as Microsoft Edge, Adobe Creative Cloud, McAfee VirusScan, and other signed applications, enabling execution through DLL side-loading and helping the malware blend with normal software activity. In some campaigns, HUI Loader was delivered through trojanized software packages; in others, operators deployed it post-compromise on already accessed systems.
HUI Loader is notable for defense-evasion functionality, including the ability to disable or bypass Windows Event Tracing for Windows and the Antimalware Scan Interface. Its operational role is primarily post-compromise staging and in-memory execution rather than standalone persistence or command-and-control. Public reporting has linked its use to campaigns targeting Japanese organizations, Southeast Asian government and gambling-sector entities, and to activity overlapping with groups and clusters such as APT10, APT41-linked operations, BRONZE STARLIGHT, and Cluster Charlie in Crimson Palace. Because Chinese threat actors frequently share tooling, HUI Loader is best understood as a shared loader used across multiple related operators rather than a uniquely actor-specific implant.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
We discovered another loader used for loading SodaMaster in 2021 ... Named after string "HUIHWASDIHWEIUDHDSFSFEFWEFEWFDSGEFERWGWEEFWFWEWD"
We discovered another loader used for loading SodaMaster in 2021 ... Named after string "HUIHWASDIHWEIUDHDSFSFEFWEFEWFDSGEFERWGWEEFWFWEWD"
The malicious DLLs libcef.dll, msedge_elf.dll, and LockDown.dll distributed by agentupdate_plugins.exe and AdventureQuest.exe are HUI Loader variants.
The malicious DLLs libcef.dll, msedge_elf.dll, and LockDown.dll distributed by agentupdate_plugins.exe and AdventureQuest.exe are HUI Loader variants.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Astaroth can launch itself via DLL Search Order Hijacking.
Execution Flow of HUI Loader ... XOR decode & code injection ... svchost.exe
Execution Flow of HUI Loader ... XOR decode & code injection ... svchost.exe
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Signed DLL with encrypted shellcode ... Legitimate file ... DLL Side-Loading
APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Astaroth can launch itself via DLL Search Order Hijacking.
the benign file identity_helper.exe sideloaded the HUI loader (msedge_elf.dll), which de-obfuscated the file log.ini to reveal a Cobalt Strike reflective Loader and a Cobalt Beacon injected into mstsc.exe
The content repeatedly describes threat actors and malware disabling or modifying security tools, EDR/AV, logging, firewall rules, integrity checkers, and security settings; e.g., 'Agrius used several mechanisms to try to disable security tools' and 'BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.'
agentupdate_plugins.exe and AdventureQuest.exe deploy .NET executables based on the SharpUnhooker tool, which download second-stage data from Alibaba buckets hosted at agenfile.oss-ap-southeast-1.aliyuncs[.]com and codewavehub.oss-ap-southeast-1.aliyuncs[.]com. The second-stage data is stored in password-protected zip archives.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.