TF-1931934
high
📛 Threat Title
Unknown Loader: Domain name that delivers a malware payload replacementwindowsmesa.net
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:37:18 UTC. Last seen: 2026-09-24 07:47:45 UTC. Reporter: varysz. Tags: etherhiding, victim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
replacementwindowsmesa.net
IOC database
- Type
- domain
- Value
replacementwindowsmesa.net- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to Unknown Loader
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:37:18 UTC. Last seen: 2026-09-24 07:47:45 UTC. Reporter: varysz. Tags: etherhiding, victim.
Remediations (10)
-
web:cyberpress.org
A previously undocumented malware loader , dubbed SynkLoader, that combines Python, C#, and native C++ components to evade detection, steal Windows credentials, and enable deep network access.
-
web:cybersecuritynews.com
An unrecorded .NET Loader was identified during routine threat hunting that downloads, decrypts, and executes a wide range of malicious payloads . Multiple threat actors extensively distributed this new loader in early June 2023 through the following mediums:- Security analysts appointed this name ...
-
web:cybersecuritynews.com
A sophisticated .NET multi-stage malware loader has been actively targeting Windows systems since early 2022, serving as a distribution channel for dangerous payloads including information stealers and remote access trojans. This loader employs a complex three-stage deployment mechanism that helps it evade detection while delivering malicious software to compromised machines. The threat has ...
-
web:socprime.com
The initial malware communicated with a command-and-control server at 89.110.110.119 over TCP port 443 using encoded traffic. The campaign, tracked as SmartApeSG ClickFix, relied on malicious scripts and a CAB archive to install the NetSupport RAT on victim systems.
-
web:www.csa.gov.sg
Update your systems, applications and software to the latest versions and use an up-to-date anti-virus software to detect malware and malicious phishing links. Implement Security Information and Event Management (SIEM) solutions to perform logging, asset visibility, and continuous system monitoring to detect anomalous network connections and ...
-
web:www.cyfirma.com
The attack delivers a hidden MSI payload that deploys a .NET-based loader , malicious DLLs, and establishes registry-based persistence while displaying a legitimate-looking decoy document to avoid suspicion.
-
web:www.malwarebytes.com
ClickFix just got more convincing, hiding malware in PNG images and faking Windows updates to make users run dangerous commands.
-
web:www.malwarebytes.com
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader .
-
web:www.microsoft.com
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.
-
web:www.rapid7.com
Rapid7 Labs has identified an ongoing, widespread compromise of legitimate WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant (impersonating a Cloudflare human verification challenge [CAPTCHA]). The lure can be used for financial theft or to conduct further, more targeted attacks against organizations.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.