s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

TF-1932120 high

📛 Threat Title

Unknown Loader: Domain name that delivers a malware payload vidracariakingglass.com.br

Category: Unknown Loader Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:38:12 UTC. Last seen: 2026-09-24 07:56:41 UTC. Reporter: varysz. Tags: etherhiding, victim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain vidracariakingglass.com.br UrlVoid 3 / 36

IOC database

Type
domain
Value
vidracariakingglass.com.br
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain name that delivers a malware payload attributed to Unknown Loader

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:38:12 UTC. Last seen: 2026-09-24 07:56:41 UTC. Reporter: varysz. Tags: etherhiding, victim.

Remediations (10)

  • web:blog.sicuranext.com

    A real-world ClickFix intrusion observed from both sandbox and endpoint telemetry, revealing the complete attack path from a compromised WordPress site to a blocked GULoader execution, including a full process creation call stack from the Windows Run dialog to the kernel.

  • web:darkwebinformer.com

    A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.

  • web:forums.malwarebytes.com

    Hacked sites deliver Vidar infostealer to Windows users by Gabriele Orini | March 16, 2026In recent years, ClickFix and fake CAPTCHA techniques have become a popular way for cybercriminals to distribute malware . Instead of exploiting a technical vulnerability, these attacks rely on convincing peo...

  • web:radar.cloudflare.com

    Understand the security, performance, technology, and network details of a URL with a publicly shareable report.

  • web:reliaquest.com

    Learn about the role of malware loaders in cybercriminal campaigns, their distribution methods, and strategies for detection and mitigation .

  • web:www.huntress.com

    Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.

  • web:www.malwarebytes.com

    We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.

  • web:www.malwarebytes.com

    We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware .

  • web:www.microsoft.com

    An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.

  • web:www.pointwild.com

    This chain highlights a layered and obfuscated delivery mechanism combining Go-based compilation, script-based execution (VBS and PowerShell), and non-executable file-based payload staging (JPEG and TXT), along with direct IP-based communication to bypass domain reputation systems and complicate analysis.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.