TF-1812263 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-05-14 18:31:09 UTC. Reporter: burger. Tags: WeedHack.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-05-14 18:31:09 UTC. Reporter: burger. Tags: WeedHack.

• persistent process with a space named "RuntimeBroker .exe"
  web:forums.malwarebytes.com

  NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. This will attempt to look for rogue files in 3 specific areas, for files named "runtimebroker".

  2026-05-22 00:46 UTC
• Free URL Safety Checker - LinkGuard Malware & Phishing Scanner
  web:linkguard.co

  Check any URL for malware and phishing threats. Free instant scanning powered by Google Safe Browsing and VirusTotal.

  2026-05-22 00:46 UTC
• RuntimeBroker.exe (Runtime Broker) Explained: What It Does and How to ...
  web:malwaretips.com

  Most of the time, RuntimeBroker.exe is completely legitimate. It is a Windows process that helps manage permissions for modern apps. But, like many system-sounding names, it is also a target for malware impersonation. Fake copies often hide in unusual folders, use subtle naming tricks, or lack a valid Microsoft digital signature. This article breaks down what RuntimeBroker.exe does, how to ...

  2026-05-22 00:46 UTC
• URL Scanner - Cloudflare Radar
  web:radar.cloudflare.com

  Understand the security, performance, technology, and network details of a URL with a publicly shareable report.

  2026-05-22 00:46 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-05-22 00:46 UTC
• Malicious URL Scanner | Scan URLs for Malware | URL Checker
  web:www.ipqualityscore.com

  Scan URLs for malware and phishing with our free malicious URL scanner. Check links in real-time to detect suspicious domains and prevent cyber threats.

  2026-05-22 00:46 UTC
• How to Remove RuntimeBroker.exe Malware Impersonator
  web:www.itfunk.org

  Normally, this process is lightweight, running silently in the background and using minimal system resources—typically under 20 MB of RAM and nearly 0% CPU. But just like other critical Windows processes, RuntimeBroker.exe can be exploited by threat actors who use similarly named files to mask malicious activities.

  2026-05-22 00:46 UTC
• Automated Malware Analysis Management Report for RuntimeBroker.exe ...
  web:www.joesandbox.com

  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) Uses schtasks.exe or at.exe to add and modify task schedules AV process strings found (often used to terminate AV products) Allocates memory with a write watch (potentially for evading sandboxes) Contains functionality to call native functions

  2026-05-22 00:46 UTC
• CSIRT-IE: Active Malware Distribution Sites
  web:www.ncsc.gov.ie

  CSIRT-IE monitors the URLhaus dataset for reports of sites, within its jurisdiction, that are reported to be actively distributing malware . Active Malware Distribution Sites The URLhaus platform only report sites ( URLs ) that are directly being used to distribute malware .

  2026-05-22 00:46 UTC
• VirusTotal - Home
  web:www.virustotal.com

  VirusTotal Assistant Bot offers a platform for users to interact with VirusTotal's threat intelligence suite and explore artifact-related information effectively.

  2026-05-22 00:46 UTC

Only Available for Registered Users. Sign in to view.