MintsLoaderMalware
According to Orange Cyberdefense, MintsLoader is a little-known, multi-stage malware loader that has been used since at least February 2023. It has been observed in widespread distribution campaigns between July and October 2024. The name comes from a very characteristic use of an URL parameter “1.php?s=mintsXX" (with XX being numbers).From MISP Galaxy
Last reported 9 months ago, by Huntress1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1176.001Browser Extensions
“For defenders, this campaign reinforces several key points: monitor for unusual use of LOLBins like finger.exe, watch for browser extensions with suspicious permission requests or recent creation dates, and keep an eye on network traffic, whether it's beaconing to nexsnield.com,…”
- T1564.003Hidden Window
“All subprocess calls use hidden window execution with CREATE_NO_WINDOW and STARTF_USESHOWWINDOW flags with wShowWindow=0 to prevent visible console windows.”
- T1678Delay Execution
“…ction and avoid immediate association between the extension install and malicious behavior, the payload uses Chrome's Alarms API to delay execution by 60 minutes.”
- T1684Social Engineering
“The cycle repeats until the user either falls for the social engineering or removes the extension.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Dissecting CrashFix: KongTuke's New Toy“MintsLoader (YARA):”
Indicators in its reports
named in the reports above- 158.247.252[.]178in 1 report
- 170.168.103[.]208in 1 report
- hxxps://github[.]com/uBlockOrigin/uBOL-homein 1 report
- hxxps://nexsnield[.]com/install?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842in 1 report
- nexsnield[.]comin 1 report
- hxxps://nexsnield[.]com/update?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842&previous=2025.1115.1000in 1 report
- hxxp://199.217.98[.]108/bin 1 report
- 199.217.98[.]108in 1 report
- hxxp://fyvw2oiv[.]top/1.php?s=63e95be1-92e0-45c1-a928-65d63b17cd1cin 1 report
- fyvw2oiv[.]topin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/cb9c57145f4b6afbc08f24a19257ed5a/raw/e1be0cc7b7e58e4205920c019d786db636036a4c/kongtuke_dga.txtin 1 report
- hxxp://temp[.]sh/utDKu/138d2a62b73e89fc4d09416bcefed27e139ae90016ba4493efc5fbf43b66acfa.exein 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/54725bf9a7809ef480fc5e35a7521137/raw/d0a0e04504fa0e1e91850be141c9bb23608b73d7/aes256_cbc.txtin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/6aa1e36457d6dbc09ff7dd218c7c223b/raw/5e186b23d4eecd7b3b99f8b88178545ade747cd8/example.txtin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/71164efdc4d7e816b385551b38ada5ca/raw/2c9baaf2105dc7f730c6d562472780bd5535c32d/xor.txtin 1 report
- fbfce492d1aa458c…7f59db67de67in 1 report
- 6399c686eba09584…7ce7c27752f4in 1 report
- hxxps://www.dropbox[.]com/scl/fi/6gscgf35byvflw4y6x4i0/b1.zip?rlkey=bk2hvxvw53ggzhbjiftppej50&st=yyxnfu71&dl=1in 1 report
- c15f44d6abb3a2a8…bfba5832c8c6in 1 report
- c46af9ae6ab0e756…45fe7640199cin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.