TF-2020284
high
📛 Threat Title
Unknown Loader: SHA256 hash of a malware sample (payload) 0a221a2b52fbd475d24a0e5f19fa53bd7e49e07b0eec9a16b35c01bbe3480252
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown Loader. Confidence: 85. First seen: 2026-11-08 06:58:04 UTC. Reporter: Tuxxin. Tags: Loader, macho.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
0a221a2b52fbd475d24a0e5f19fa53bd7e49e07b0eec9a16b35c01bbe3480252
IOC database
- Type
- hash_sha256
- Value
0a221a2b52fbd475d24a0e5f19fa53bd7e49e07b0eec9a16b35c01bbe3480252- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown Loader. Confidence: 85. First seen: 2026-11-08 06:58:04 UTC. Reporter: Tuxxin. Tags: Loader, macho.
Remediations (10)
-
web:cipherssecurity.com
Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:github.com
The evidence supports classifying the sample as suspicious loader /dropper-style malware with confirmed HTTP behavior, file creation, registry queries, and delayed cleanup logic. The full secondary payload chain was not confirmed because the hardcoded host was unavailable in the lab and the created CR433101.dat.exe file was empty.
-
web:github.com
The first step was to calculate the sample's MD5 and SHA256 values. These hashes identify the exact file version, support threat-intelligence lookups, and make the artifact easier to search across logs, repositories, and detection tools.
-
web:imalware.com
It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:ismalicious.com
Unknown Loader sample 75b3e06376152ce2aee9187802dc56e18e35124538faaa9a3a0e2af5bff15912: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:ismalicious.com
Unknown Loader sample 9cf51d59ec0742588a9400ef1b756a9f07ed65e98f825f689baf5cfda0ec4ac7: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:onlinetoolsplanet.com
Check malware hashes online with this free Malware Hash Lookup. Enter a file hash , run the lookup, and review any public intelligence match returned for the sample .
-
web:osintdashboard.dev
Safely identify a suspicious file: compute its MD5 and SHA-256 hashes locally in the browser, look the digest up against malware databases, and cross-validate before escalating. The file itself never leaves your machine.
-
web:threathive.ai
The imphash is an MD5 too, but of the program's import table rather than of the file, so it groups related samples and is kept out of the file- hash lookup. The same reading works for SHA256 : labels in a report, JSON fields such as " sha256 ":, and lines from sha256sum, md5sum, openssl dgst, certutil -hashfile and Get-FileHash.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.