TF-1932120
high
📛 Threat Title
Unknown Loader: Domain name that delivers a malware payload vidracariakingglass.com.br
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:38:12 UTC. Last seen: 2026-09-24 07:56:41 UTC. Reporter: varysz. Tags: etherhiding, victim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
vidracariakingglass.com.br
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
vidracariakingglass.com.br- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to Unknown Loader
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:38:12 UTC. Last seen: 2026-09-24 07:56:41 UTC. Reporter: varysz. Tags: etherhiding, victim.
Remediations (10)
-
web:blog.sicuranext.com
A real-world ClickFix intrusion observed from both sandbox and endpoint telemetry, revealing the complete attack path from a compromised WordPress site to a blocked GULoader execution, including a full process creation call stack from the Windows Run dialog to the kernel.
-
web:darkwebinformer.com
A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.
-
web:forums.malwarebytes.com
Hacked sites deliver Vidar infostealer to Windows users by Gabriele Orini | March 16, 2026In recent years, ClickFix and fake CAPTCHA techniques have become a popular way for cybercriminals to distribute malware . Instead of exploiting a technical vulnerability, these attacks rely on convincing peo...
-
web:radar.cloudflare.com
Understand the security, performance, technology, and network details of a URL with a publicly shareable report.
-
web:reliaquest.com
Learn about the role of malware loaders in cybercriminal campaigns, their distribution methods, and strategies for detection and mitigation .
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.malwarebytes.com
We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.
-
web:www.malwarebytes.com
We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware .
-
web:www.microsoft.com
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.
-
web:www.pointwild.com
This chain highlights a layered and obfuscated delivery mechanism combining Go-based compilation, script-based execution (VBS and PowerShell), and non-executable file-based payload staging (JPEG and TXT), along with direct IP-based communication to bypass domain reputation systems and complicate analysis.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.