Loading malware…
StealthMutant is a Windows shellcode loader written in C# and associated with the China-linked espionage activity tracked as Earth Baku, also known as APT41. It has been observed in intrusions targeting organizations in the Indo-Pacific region, including enterprises and government-related victims in sectors such as airlines, automotive, infrastructure, media, publishing, information technology, and computer hardware. The malware has also been linked to later post-exploitation activity involving Taiwanese victims.
StealthMutant functions as an in-memory loader for follow-on payloads, notably Cobalt Strike Beacon and the modular backdoor ScrambleCross. Its core behavior centers on decrypting an embedded or external shellcode blob and injecting the resulting payload into another process. Reported variants used AES-256 decryption, while older samples used XOR. Execution commonly relies on process hollowing and related remote-process injection techniques, including use of native section-mapping APIs. The malware has been observed injecting into legitimate Windows processes to conceal execution.
A notable stealth feature is its ability to disable Event Tracing for Windows by patching ETW-related functionality, reducing host telemetry and complicating detection. Samples have also been seen obfuscated with ConfuserEx. Operationally, StealthMutant has appeared as part of multi-stage intrusion chains in which attackers established access through exploitation of internet-facing services, web-shell deployment, or possible malicious attachment delivery, then used scheduled tasks and InstallUtil-based execution to launch the loader.
StealthMutant has been documented both as a companion to StealthVector and as part of broader APT41 tradecraft overlapping with ScrambleCross and related tooling. In later investigations, loader behavior strongly resembling StealthMutant was identified in post-exploitation workflows that used staged shellcode and DLL components, reinforcing its role as a stealth-focused loader within long-term espionage operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
StealthMutant, a C# implementation of StealthVector, executes its payload by performing process hollowing, a technique widely used by both malicious actors and red teams.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
StealthMutant, a C# implementation of StealthVector, executes its payload by performing process hollowing, a technique widely used by both malicious actors and red teams.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
StealthMutant uses XOR or AES-256-ECB to decrypt the payload. StealthVector uses ChaCha20 to decrypt both the configuration and the payload. The main function of ScrambleCross is encoded by XOR and its configuration is encrypted by ChaCha20.
Most of the StealthMutant samples we have come across are obfuscated by ConfuserEx
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A C# shellcode loader derived from StealthVector that executes payloads via process hollowing, can disable ETW to evade Windows logging, and typically decrypts payloads with AES-256-ECB, with older versions using XOR.
A loader referenced for comparison because the observed execution flow resembled previously reported tooling; it is not the primary malware discussed in this reference.
.NET-based loader for ScrambleCross that AES-256 decrypts a shellcode blob and injects it into another process (observed: msdt.exe); executed via InstallUtil-based launcher/service or via scheduled task persistence.
An evasive C# shellcode loader that decrypts AES-256-ECB- or XOR-protected payloads in memory, disables ETW by patching EtwEventWrite, and executes payloads via process hollowing into remote processes. Observed payloads are Cobalt Strike Beacon and ScrambleCross.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.