MB-ace5bd012ba9a7250286a9258aba3474c12f1ef5c50e98a388aec9e535e84e3b
high
📛 Threat Title
Unknown: loader.sh
Description
File type: unknown. Size: 581 bytes. Reporter: BlinkzSec. First seen: 2026-05-14 20:05:49.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
loader.sh
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/loader.sh
UrlVoid 4 / 35
IOC database
- Type
- domain
- Value
loader.sh- First seen
- Last seen
- Attached to this threat
- Appears in
- 6 threats
- Description
- Extracted from Threat MB-ace5bd012ba9a7250286a9258aba3474c12f1ef5c50e98a388aec9e535e84e3b
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/loader.sh
hash_sha256
ace5bd012ba9a7250286a9258aba3474c12f1ef5c50e98a388aec9e535e84e3b
1 feed
IOC database
- Type
- hash_sha256
- Value
ace5bd012ba9a7250286a9258aba3474c12f1ef5c50e98a388aec9e535e84e3b- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Unknown
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
0a0876e21274f4d8b60d992bf214e248
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/0a0876e21274f4d8b60d992bf214e248
1 feed
IOC database
- Type
- hash_md5
- Value
0a0876e21274f4d8b60d992bf214e248- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/0a0876e21274f4d8b60d992bf214e248
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: unknown. Size: 581 bytes. Reporter: BlinkzSec. First seen: 2026-05-14 20:05:49.
Remediations (10)
-
web:askubuntu.com
9 Update: Kernel 6.8.-117.117 is released now and features a kernel-level fix for CVE-2026-31431. While the website may be down, the security email list continues to work apparently and they have emailed about a mitigation there in an email from 30.04.2026 18:06 CET. The issue should be mitigated for now thanks to USN-8226-1 and USN-8226-2.
-
web:github.com
Shares the affected xfrm # code path; called out by AWS Security Bulletin # 2026-027 as part of the mitigation set. # * rxrpc — RxRPC protocol stack (CVE-2026-43500). # # The remediation is idempotent — running it repeatedly has no # additional effect once the blacklist file is in place and the # modules are unloaded.
-
web:gitlab.com
I'm not entirely sure what's going wrong, but it appears there's no trivy db available on the self-hosted instance.
-
web:knowledge.broadcom.com
CVE-2026-22719 has direct impact to Aria Operations 8.18.x, and Aria Operations 9.0.x This vulnerability and its impact on the mentioned VMware products are documented in the following VMware Security Advisory (VMSA), please review this document before continuing: CVE-2026-22719 - VMSA-2026-0001 See the Change log at the end of this article for all changes and subscribe to the article for updates.
-
web:scloud.work
When a proactive remediation script fails to work as expected, it's much faster to test it locally than wait for the next sync from Intune. In this post, I'll show you how I troubleshoot Intune remediation scripts directly on a Windows device. This includes script locations, relevant logs, and registry entries that help verify what […]
-
web:techdocs.f5.com
Usage information and technical documentation for BIG-IP and other related F5 products
-
web:windowsforum.com
A critical deserialization vulnerability in Fuji Electric's FRENIC-Loader 4 — tracked as CVE‑2025‑9365 and given a CVSS v4 base score of 8.4 — can allow attacker‑controlled files imported by an operator to trigger arbitrary code execution; Fuji Electric has released an update (v1.4.0.1 or later) and CISA has published an advisory urging rapid remediation and network hardening.
-
web:www.anonymoushackers.net
This article explores what PowerShell loader malware is, how it works, techniques for detection, real-world attack examples, and mitigation strategies.
-
web:www.reddit.com
If you don't have the in house staff to perform the threat analysis or threat hunting, you need a SOC. You could look at black point cyber since your are a PAX 8 customer. You currently have the detection portion of EDR, but not the analysis and remediation piece. You can't compare Symantec to Sentinel One, they aren't the same. Sentinel One IMO, is a far superior product, and in the years we ...
-
web:www.unknowncheats.me
hello everyone, i was wondering what methods to protect the loader are available and which of them are more reliable. interested in both the client pa
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.