Loading malware…
YouieLoader is malware associated with the North Korean threat actor Moonstone Sleet. Based on the provided content, it functions as an intermediate loader used alongside SplitLoader and is capable of capturing victim system browser information. The content also attributes system owner/user discovery functionality to YouieLoader and states that Moonstone Sleet used loader malware such as YouieLoader to create malicious Windows services for execution. In the broader intrusion context described, Moonstone Sleet delivered malware through phishing and trojanized software, staged payloads on adversary-controlled VPS infrastructure, retrieved additional payloads over web protocols, and used persistence and execution mechanisms including Registry Run keys, scheduled tasks, and service creation. High-confidence details specific to YouieLoader from the content are that it is a Moonstone Sleet-deployed loader malware family that captures browser information from victim systems, performs user/system owner discovery, and is used in service-based execution chains.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Moonstone Sleet deployed malware such as YouieLoader capable of capturing victim system browser information.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking admin status, and enumerating user sessions.
APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.