CountLoader
CountLoader is a multi-stage Windows malware loader, frequently implemented as an HTA-based loader executed via mshta.exe, that has been active in the wild since at least June 2025. It is distributed through multiple vectors including cracked software and fake software download sites, SEO poisoning, fake social media posts, direct messages, phishing chains using CHM/HTA content, trojanized installers disguised as CCleaner, and HTML Application payloads disguised with benign extensions such as .wav, .xml, .mp4, .ini, .csv, and .rar. It has also been observed using a lure filename designed to target security researchers: "source code of carbanak backdoor discovered.exe." CountLoader additionally supports USB propagation by replacing files on removable media with malicious LNK shortcuts.
The malware uses layered obfuscation and staged delivery involving malicious EXE launchers, PowerShell, obfuscated JavaScript, HTA execution through mshta.exe, shellcode injection, and in-memory payload execution. Reported behaviors include hiding the HTA window, self-deletion attempts, AMSI bypass, anti-sandbox checks for hostnames such as AZURE-PC and username Bruno, antivirus/process checks including CrowdStrike Falcon, and persistence via scheduled tasks and, in some reporting, an HKCU Run key. It fingerprints infected hosts, communicates with command-and-control infrastructure using a custom encrypted/XOR-plus-base64 protocol, performs an encrypted handshake, and in some cases obtains JWT tokens for authenticated follow-on requests. Observed tasking includes download-and-execute of EXE, DLL, MSI, HTA, Python, and PowerShell payloads, self-uninstall, browser-data theft, LOLBIN-based download, arbitrary HTA/PowerShell execution, domain or Active Directory reconnaissance, and USB spreading.
CountLoader has been used to deliver multiple follow-on payloads, including cryptocurrency clipper malware, LummaStealer, Amatera, Cobalt Strike, AdaptixC2, PureHVNC RAT, PureMiner, and ACR Stealer. In one large McAfee-observed campaign, the final payload was a cryptocurrency clipper running under systeminfo.exe that monitored clipboard contents and replaced copied wallet addresses with attacker-controlled ones; that payload used EtherHiding to retrieve C2 information from the Ethereum blockchain. Separate reporting linked CountLoader activity to a prior crypto-clipper cluster and assessed overlap with the actor behind the Silent Swap campaign.
Breakglass Intelligence described CountLoader as a professionally operated malware-as-a-service platform disguised as a CCleaner installer. That reporting states it targets more than 50 cryptocurrency wallet extensions across more than 40 browsers; later campaign reporting specified targeting of 76 cryptocurrency wallet browser extensions, six desktop wallet applications, and data from 66 Chromium-based browsers. Named targets include MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Rabby, Ledger Live, Trezor, Exodus, Atomic Wallet, Guarda, KeepKey, and BitBox02. The same reporting also documented a dedicated Active Directory reconnaissance module that collects local system and domain information, group memberships, domain controller connectivity, Domain Admin membership, domain computers, and domain groups, making the malware relevant both for financial theft and enterprise lateral movement preparation.
Observed infrastructure and indicators include domains such as memory-scanner[.]cc, google-services[.]cc, hell1-kitty[.]cc, hell10-kitty[.]cc, alphazero1-endscape[.]cc, api-microservice-us1[.]com, bucket-aws-s1[.]com, fileless-storage-s3[.]cc, ccleaner[.]gl, web3-walletnotify[.]cc, communicationfirewall-security[.]cc, burning-edge[.]sbs, explorer[.]vg, favourite-guide[.]cc, indeanapolice[.]cc, s1-rarlab[.]com, magnusworkspace[.]com, s3-python[.]cc, node1-py-store[.]com, and node2-py-store[.]com. Reported payload/C2 URLs include https://memory-scanner[.]cc/Presentation[.]pdf and https://edr-security-bucket1[.]cc/. Additional reported indicators include the scheduled-task CLSID {0830A3F8-70B8-40E1-A0F3-E0EC9092F861}, sample SHA-256 hashes 5f9ff671955a6d551595f9838aed063c496da5039be0d222fe84f96cb3e1d32a, 4ee17ce2e1ce0ede59dceabbba28265923ce4e25ddb002617e3cc8f13cfff6a3, e27ff6646a2f98b81ea5da4d0d93127f0f3e68a5e6728f404724e388376ede84, and lure filenames including Travel_X_Config_917.wav, Photos_Daily_v3.0.xml, Meeting_Photos_Temp_6194.mp4, Europe_Dataset_Final_334.ini, Sales_Core_Data_518.csv, Omega_Data_NewYork_2087.xml, and Summer_Data_Primary_44.rar.
Victimology and scale vary by campaign. McAfee reported approximately 86,000 unique infected machines in one large campaign, with about 5,000 connections per minute to sinkholed infrastructure and the highest infection counts in India, followed by Indonesia, the United States, and parts of Southeast Asia. CountLoader has been associated with commodity malware delivery, cryptocurrency theft, and enterprise reconnaissance, and multiple reports assess it as a mature, actively maintained loader operation with rapidly rotating infrastructure.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CountLoader — previously investigated by BGI — distributes via a filename specifically designed to lure security researchers: source code of carbanak backdoor discovered.exe . | CountLoader's secondary C2 at burning-edge[.]sbs ( 65.21.174[.]205 , Hetzner) has phpMyAdmin exposed at /phpmyadmin/ , MySQL on port 3306, and 120+ CVEs including regreSSHion.
Techniques & procedures
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
3 techniques
Initial Access
Attempts to spread via USB drives by replacing files with malicious LNK shortcuts that execute the malware when opened.
Execution
7 techniques
Execution
Establishes persistence by creating a scheduled task that runs every 30 minutes.
Inside the archive is a file called Setup.exe, which is actually a legitimate Python interpreter bundled with malicious scripts that quietly launch the attack in the background.
The infection begins when an EXE file is executed. This file launches a PowerShell command, which downloads and executes an obfuscated JavaScript loader known as CountLoader.
The file is a HTA file with JavaScript that uses string obfuscation technique to evade detection.
The infection starts when a victim downloads what appears to be free or cracked software... When a user visits one of these pages, JavaScript secretly copies a malicious command to the clipboard and instructs them to press Win + R, paste it, and hit Enter.
Persistence
2 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Establishes persistence by creating a scheduled task that runs every 30 minutes.
The shellcode then loads the final payload directly into memory under systeminfo.exe, never touching the disk... | The next stages involve a PowerShell packer that decrypts and launches a shellcode injector... The shellcode then loads the final payload directly into memory under systeminfo.exe...
Stealth
6 techniques
Stealth
McAfee Labs has recently uncovered a large scale CountLoader campaign that uses multiple layers of obfuscation and staged payload delivery to evade detection.
Inside the archive is a file called Setup.exe, which is actually a legitimate Python interpreter bundled with malicious scripts... it uses a renamed MSHTA copy disguised as iso2022.exe
The shellcode then loads the final payload directly into memory under systeminfo.exe, never touching the disk... | The next stages involve a PowerShell packer that decrypts and launches a shellcode injector... The shellcode then loads the final payload directly into memory under systeminfo.exe...
The loader is executed using mshta.exe, a legitimate Windows utility often abused by malware to run scripts.
Discovery
2 techniques
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Command and Control
4 techniques
Command and Control
The attackers employ a custom encrypted communication protocol to interact with their C2 servers.
As the Python script runs, it uses a renamed MSHTA copy disguised as iso2022.exe to connect to attacker servers and fetch the next-stage payload... That single action triggers MSHTA to fetch a remote script that runs entirely in memory.
IOCs tracked for this family
177 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader campaign previously observed delivering a crypto clipper; the article cites overlap between it and Silent Swap, suggesting a shared threat actor.
A loader that abuses MSHTA during early-stage infection to fetch and deliver payloads such as LummaStealer and Amatera, often via fake or cracked software downloads.
A multi-stage loader that uses a malicious EXE, PowerShell, obfuscated JavaScript executed via mshta.exe, and shellcode injection to deliver an in-memory cryptocurrency clipper payload. It also spreads via USB by replacing files with LNK shortcuts, maintains persistence with scheduled tasks, disables AMSI, and communicates with rotating C2 infrastructure.
A multi-stage malware loader observed in active campaigns using MSHTA as part of the execution chain to retrieve malicious payloads.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.