TF-1931917
high
📛 Threat Title
Unknown Loader: Domain name that delivers a malware payload rafamecanicamultimarcas.com.br
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:37:17 UTC. Last seen: 2026-09-24 07:47:44 UTC. Reporter: varysz. Tags: etherhiding, victim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
rafamecanicamultimarcas.com.br
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
rafamecanicamultimarcas.com.br- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to Unknown Loader
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:37:17 UTC. Last seen: 2026-09-24 07:47:44 UTC. Reporter: varysz. Tags: etherhiding, victim.
Remediations (10)
-
web:darkwebinformer.com
A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.
-
web:radar.cloudflare.com
Understand the security, performance, technology, and network details of a URL with a publicly shareable report.
-
web:redcanary.com
HijackLoader, also known as IDAT Loader , GHOSTPULSE, or SHADOWLADDER, is a malware loader that delivers additional payloads through process injection. In use since at least July 2023, multiple adversary groups leverage HijackLoader to deliver a wide array of payloads , including stealers and RATs.
-
web:reliaquest.com
Learn about the role of malware loaders in cybercriminal campaigns, their distribution methods, and strategies for detection and mitigation .
-
web:reliaquest.com
Malware loaders are tricky business for SOC teams. Mitigation for one loader may not work for another, even if it loads the same malware . And they're one of the most common tools for a cyber-threat actor to secure initial access to a network, then help drop payloads (remote-access software and post-exploitation tools are popular choices). ReliaQuest has uncovered a load of loaders causing ...
-
web:socprime.com
DeepLoad is a fileless malware family distributed through ClickFix social engineering. It relies on an obfuscated PowerShell loader , in-memory shellcode injection into trusted Windows processes, and AI-generated "noise" to reduce static-detection fidelity.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown . You can also get this data through the ThreatFox API. Database Entry
-
web:www.huntress.com
SmokeLoader is a modular downloader Trojan primarily used to deliver additional malware onto compromised systems. Originally discovered in the early 2010s, it has gained notoriety for its advanced evasion techniques and adaptability to new attack campaigns. Known aliases include Smoke Bot and Dofoil. It is often leveraged by malicious actors in cybercrime for credential theft, surveillance ...
-
web:www.malwarebytes.com
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader .
-
web:www.security.org
Our free link checker scans any URL for phishing, malware , and scam indicators in seconds. No sign-up required, and it works on links from email, text, or social media.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.