When YouTube Becomes the Vector: Malware Delivered Through Trusted Content

Executive Summary

A widespread malware campaign is actively abusing YouTube videos and cracked software downloads to infect Windows systems. Attackers lure users with promises of free software, license bypass tools, or game cheats. Once the user downloads and runs the advertised installer, their system is silently compromised.

Instead of delivering obvious malware immediately, the attackers use loader malware—primarily CountLoader and GachiLoader—to establish a foothold. These loaders quietly prepare the system, evade security controls, and then download additional malicious payloads such as credential stealers, remote access tools, and post-exploitation frameworks.

The infection is designed to remain hidden for long periods, often going unnoticed until sensitive data is stolen or follow-on attacks occur.

How the Attack Works (Step-by-Step)

1. Initial Lure

Attackers upload or reuse YouTube videos advertising:

Cracked or “activated” versions of paid software
Game cheats, mods, or trainers
License bypass or activation tools

The videos appear legitimate and often reuse real tutorials. A download link is placed in the description or comments, usually pointing to a well-known file-hosting service. Passwords are commonly provided to “unlock” the archive.

2. Downloaded Content

The downloaded ZIP archive typically:

Is password-protected to evade antivirus scanning
Contains a fake installer (e.g., Setup.exe, Activator.exe)
May include a text or Word file explaining how to “install” the software

The executable inside is not the promised application. It is malware disguised as an installer.

3. Initial Execution

When the user runs the file:

A legitimate-looking binary (often a renamed Python or Node.js runtime) is executed
This binary launches embedded malicious scripts or commands

At this point, CountLoader or GachiLoader becomes active.

Malware Components Explained

CountLoader

CountLoader is a flexible, multi-stage loader used to establish initial access.

What it does:

Collects system information (OS, user privileges, security software)
Downloads additional malware from attacker-controlled servers
Executes payloads directly in memory

Key traits:

Uses legitimate Windows tools like mshta.exe and PowerShell
Creates long-lived scheduled tasks with legitimate-looking names
Adjusts behavior when security tools are detected
Can propagate via removable drives using malicious shortcut files

Why it’s dangerous:
CountLoader itself is quiet, but it opens the door for far more damaging malware.

GachiLoader

GachiLoader is a more advanced loader built on Node.js and heavily obfuscated.

What it does:

Delivers second-stage malware only after validating the environment
Performs extensive anti-analysis and anti-sandbox checks
Communicates with its servers using encrypted traffic and custom headers

Key traits:

Distributed as a large executable containing an embedded Node.js runtime
Can weaken or modify Windows Defender settings
Deploys an additional loader called Kidkadi

Kidkadi (Second-Stage Loader)

Kidkadi is used after GachiLoader has successfully executed.

What it does:

Injects malicious code directly into memory
Abuses Windows exception-handling mechanisms
Makes malicious code appear as a legitimate system DLL

This technique allows malware to run without clearly visible files on disk.

Final Payloads

Once the loaders finish preparing the system, attackers deploy final-stage malware such as:

Credential and browser data stealers
Cryptocurrency wallet stealers
Remote access trojans (RATs)
Post-exploitation frameworks for long-term control

At this stage, the system is fully compromised.

How the System Is Compromised (Simplified Technical View)

Trusted binary abuse: Legitimate Windows tools are used to execute malicious code.
Fileless execution: Much of the malware runs only in memory.
Persistence: Scheduled tasks ensure execution survives reboots.
Defense evasion: Malware adapts based on installed security products.
Stealthy injection: Advanced memory techniques disguise malicious code as legitimate components.

Indicators of Compromise (IOCs)

These indicators should be used for investigation and correlation. Validate activity before taking action.

File Hash Indicators (GachiLoader / Rhadamanthys)

Malicious ZIP Archives (Examples)

062d342f59136c3bbc729e0c412d2c2589b6f9058912583eeb9b61d7916db00e
34e1cd959c0c586fcd495225803061e6e2a19e7818c47a46a47822ba6726500d

These archives typically contain disguised installers or activators.

Loader and Second-Stage Hashes

GachiLoader (Node.js-based):

00bcfecad4b679f72c50cbdcd883caf55b6a1f641258a636317871c7b8940156

Kidkadi (Second-stage injector):

2ac4f1a2e22c99a823f18dba8ad5aafde0de98966d5534d5af61650d1f47997c

Command-and-Control Infrastructure

Domains Observed

davpniktonevidit[.]cfd
nupogodi[.]cfd
nexus-cloud-360[.]com
globalmarket247online[.]com

IP Addresses

94.154.35.99
176.46.152.18
213.209.150.104

Rhadamanthys Network Patterns

176.46.152.18:8181/...
94.154.35.99:1888/...

These connections often occur shortly after initial execution.

CountLoader-Related Domains

app-updater[.]app
app-updater1[.]app
app-updater2[.]app
grouptelecoms[.]com
limenlinon[.]com
misctoolsupdate[.]com
ms-team-ping2[.]com
officetoolservices[.]com
onlinenetworkupdate[.]com
quasuar[.]com

Behavioral Indicators (Highly Important)

Suspicious Scheduled Tasks

Tasks named like legitimate update services (e.g., GoogleTaskSystem*)
Tasks running very frequently or scheduled years into the future
Tasks executing scripts or binaries from user-writable directories

Living-Off-the-Land Abuse

mshta.exe reaching out to remote URLs
PowerShell running encoded or obfuscated commands

Process & Memory Anomalies

Large executables with embedded Node.js runtimes (60–90 MB)
Node.js processes on systems where Node is not normally installed
DLLs behaving inconsistently with their file names

Security Configuration Changes

Unexpected Windows Defender exclusions for:
- C:\Users\*
- C:\ProgramData\*
- C:\Windows\*
Defender real-time protection disabled after installer execution

What To Do If Infection Is Suspected

Immediate Actions

Disconnect the system from the network
Preserve logs and running process information
Review scheduled tasks and Defender configuration
Avoid running unknown cleanup tools prematurely

Recovery and Remediation

Assume credentials used on the system are compromised
Reset passwords and revoke sessions
Reimage the system from a trusted source (recommended)
Monitor for lateral movement or reuse of stolen credentials

Prevention and Hardening

Block execution of mshta.exe where possible
Restrict script engines for standard users
Use application allowlisting
Monitor scheduled task creation
Educate users about cracked software risks

Final Takeaway

This campaign succeeds because it exploits trust and curiosity, not software vulnerabilities. Users willingly run the malware believing it is legitimate software. Once executed, the compromise is silent, persistent, and difficult to detect.

Cracked software and YouTube-based installers should be treated as high-risk by default.