TF-2019839
high
📛 Threat Title
Unknown Loader: Domain name that delivers a malware payload questiongk.in
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-11-08 00:26:31 UTC. Last seen: 2026-11-08 00:27:25 UTC. Reporter: varysz. Tags: etherhiding.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
questiongk.in
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
questiongk.in- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to Unknown Loader
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-11-08 00:26:31 UTC. Last seen: 2026-11-08 00:27:25 UTC. Reporter: varysz. Tags: etherhiding.
Remediations (10)
-
web:cybersecurefox.com
A malware loader is malicious software that gains a foothold on a device and then downloads and runs additional malware from attacker-controlled servers, acting as the first stage of a multi-stage infection.
-
web:cybersecuritynews.com
ROMULUS platform uses ClickFix traps, PowerShell scripts and fake installers to deliver malware and infect Windows systems.
-
web:ismalicious.com
13,980 indicators of compromise attributed to the Unknown Loader malware family — domains , IPs, URLs and file hashes, plus 1 exploited CVEs, from abuse.ch feeds.
-
web:nhimg.org
Loader malware is code whose main job is to establish execution and fetch a later payload rather than deliver the full attack immediately. It often gathers basic telemetry, checks environment details, and then retrieves a second stage that can be updated independently by the attacker.
-
web:nhimg.org
A malware loader is an initial component designed to deliver , unpack, or stage a second payload rather than do all the damage itself. Loaders are commonly used to evade inspection, establish persistence, and prepare the environment for more destructive tooling such as ransomware, remote access payloads , or credential theft implants.
-
web:nhimg.org
A loader checks system language, domain membership, or security tools before deciding whether to deploy a ransomware module or a quieter persistence package. A malware operator rotates the second-stage payload without changing the loader , allowing rapid adaptation when defenders begin flagging one module but not another.
-
web:socradar.io
A malware loader is code whose primary purpose is to retrieve, unpack, inject, or execute another malicious payload . Loaders give operators a small initial foothold that can be updated with an infostealer, ransomware, remote access Trojan, or campaign-specific module after the victim is assessed. A loader is defined by its role in the infection chain, not by one file type or technique. Some ...
-
web:undercodetesting.com
Introduction: Cybercriminals are increasingly abusing DNS TXT records to deliver malware and command-and-control (C2) payloads covertly. A recent investigation by DomainTools revealed how attackers fragment, hex-encode, and distribute malicious code across multiple DNS queries, evading traditional security measures.
-
web:www.malwarebytes.com
We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware .
-
web:www.packetlabs.net
Loader malware plays a critical role in the middle stages of the cyber attack lifecycle. Explore how attackers use it to import various types of malware in the attacker's environment.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.