HUI Loader — Malware Profile

HUI Loader is a custom DLL loader that has been used since at least 2015 by China-based threat groups including Cinnamon Tempest and menuPass to deploy malware on compromised hosts. HUI Loader has been observed in campaigns loading SodaMaster, PlugX, Cobalt Strike, Komplex, and several strains of ransomware.

MITRE ATT&CK techniques (3)

• T1140 Deobfuscate/Decode Files or Information
• T1574.001 DLL
• T1685 Disable or Modify Tools

Attributed threat actors

• Cinnamon Tempest
• APT10

Read the full analysis on IntelFusions