CLAIMLOADER

Malware & Tools · CLAIMLOADER

· MalwareS1236 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

CLAIMLOADER is a malware variant that frequently accompanies legitimate executables that are used for DLL side-loading known to be leveraged by Mustang Panda and was first observed utilized in 2021.(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)

Tactic Coverage

stealth (6)execution (5)persistence (2)privilege escalation (2)

Used By (1 groups)

G0129Mustang PandaTA416, RedDelta

Techniques (11)

T1027.007Dynamic API Resolution

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1053.005Scheduled Task

executionpersistence

T1106Native API

execution

T1140Deobfuscate/Decode Files or Information

stealth

T1204.002Malicious File

execution

References

https://attack.mitre.org/software/S1236 https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan