MalwarePublished 29 Apr 2025Updated 29 May 2025

MintsLoader Malware Analysis: Multi-Stage Loader Used in Cyber Attacks

Source AlienVault OTX General

Description

MintsLoader, a malicious loader first observed in 2024, is employed in phishing and drive-by download campaigns to deploy payloads like GhostWeaver, StealC, and modified BOINC clients. It uses obfuscated JavaScript and PowerShell scripts in a multi-stage infection chain, featuring sandbox evasion techniques, a domain generation algorithm, and HTTP-based C2 communications. Various threat groups, including TAG-124 and SocGholish operators, utilize MintsLoader to target industrial, legal, and energy sectors. The loader's sophisticated obfuscation and evasion methods complicate detection, but Recorded Future's Malware Intelligence Hunting provides up-to-date information on new samples and C2 domains.

Impact

For European organizations, MintsLoader poses a significant risk due to its targeting of critical sectors such as industrial, legal, and energy, which are vital to the European economy and infrastructure. Successful infections can lead to data theft, espionage, disruption of industrial control systems, and unauthorized access to sensitive legal documents. The multi-stage infection chain and use of sophisticated evasion techniques increase the likelihood of prolonged undetected presence within networks, enabling attackers to establish persistent footholds and conduct further malicious activities. The deployment of payloads like StealC indicates potential credential theft and espionage, while GhostWeaver suggests capabilities for remote access and control. The use of modified BOINC clients may allow attackers to disguise malicious activity as legitimate distributed computing tasks, complicating detection. The threat’s reliance on phishing and drive-by downloads means European organizations with large remote workforces or extensive web-facing assets are particularly vulnerable. The dynamic C2 infrastructure via DGAs further complicates incident response and containment efforts. Overall, MintsLoader could lead to significant confidentiality breaches, operational disruptions, and reputational damage within European enterprises.

Defensive guidance

To effectively mitigate MintsLoader, European organizations should implement a multi-layered defense strategy tailored to its technical characteristics. First, enhance email security by deploying advanced phishing detection solutions that analyze email content, URLs, and attachments for obfuscation and malicious scripts. Employ sandboxing technologies capable of detecting multi-stage payloads and evasion techniques. Network defenses should include DNS monitoring and blocking of suspicious domains generated by DGAs, leveraging threat intelligence feeds that track MintsLoader’s C2 domains. Endpoint detection and response (EDR) solutions must be tuned to identify anomalous PowerShell and JavaScript execution patterns, especially those exhibiting obfuscation or unusual network behavior. Implement strict application control policies to restrict execution of unauthorized scripts and binaries. Regularly update and patch all software, particularly browsers and email clients, to reduce drive-by download risks. Conduct targeted user awareness training focusing on phishing and social engineering tactics used by threat actors. Finally, integrate threat intelligence platforms like Recorded Future to receive timely updates on new MintsLoader indicators and adapt defenses accordingly. Incident response plans should include procedures for rapid identification and containment of multi-stage infections and C2 communications.

Indicators of compromise

Domains 88

1berumerb.shop
acibbnijcehcmbi.top
acrtyfmjdxpvnha.top
akclafkefbcdala.top
anccvfsrkauefoh.top
baredaseco.pro
bfidmcjejlilflg.top
bnbuzu49ibz4.top
bnzuyeubizh3f.top
bnzyewtreugbhbw.top

URLs 138

http://1berumerb.shop/1.php?s=flibabc21
http://acibbnijcehcmbi.top/
http://acibbnijcehcmbi.top/1.php?s=524
http://acibbnijcehcmbi.top/1.php?s=flibabc22
http://acrtyfmjdxpvnha.top/1.php?s=527
http://akclafkefbcdala.top/
http://akclafkefbcdala.top/1.php?s=521
http://akclafkefbcdala.top/1.php?s=523
http://akclafkefbcdala.top/1.php?s=flibabc14
http://anccvfsrkauefoh.top/1.php?s=527

Hashes 330

0518287873d4fb8925ae78fdcca2fcf4
0cadda90656d0e38c804cecb4abdfe51
1151e302c4e0997f70d8ed0dd799243f
1b129d080655a4c9f703a5dce0195512
1c9e2f58cc773e8f1e4b52788dccb904
27d26760ad0bf8a5be7ab787d053e278
2a31f5286e163f5467447a1e8378c2d6
2bf5f75aff532c360c417f604621f4b9
3be68578329e2b1bc89396e6d6f00cb4
3d7a97e422c6f4fc9e7198d94b865dec

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Jun 2025, 13:58 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

Domains 88

URLs 138

Hashes 330

Community reviews

Related threats