{ "count": 254, "indicators": [ { "ioc_value": "this.agentRef.loader", "ioc_type": "domain", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "e.runtime.loaderType", "ioc_type": "domain", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "e.loaderType", "ioc_type": "domain", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "this.loader", "ioc_type": "domain", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "e.loader", "ioc_type": "domain", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "https:\/\/dfrlab.org\/wp-includes\/js\/wp-emoji-loader.min.js", "ioc_type": "url", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "nr-loader-spa-1.319.0.min.js.LICENSE.txt", "ioc_type": "domain", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "win.smokeloader", "ioc_type": "malware", "category": "Malware Attribution", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:07:43", "last_seen": "2026-08-06 19:46:51" }, { "ioc_value": "https:\/\/github.com\/chester1900\/TXT-TO-VIDEO-LEECH-UPLOADER\/raw\/refs\/heads\/main\/dodecahydrated\/T_TX_VIDE_LEEC_UPLOADER_3.7.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:41", "last_seen": "2026-08-06 19:46:49" }, { "ioc_value": "https:\/\/bernasibutuwqu2.com\/debug\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:49", "last_seen": "2026-08-06 19:46:49" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/chester1900\/TXT-TO-VIDEO-LEECH-UPLOADER\/refs\/heads\/main\/dodecahydrated\/T_TX_VIDE_LEEC_UPLOADER_3.7.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:41", "last_seen": "2026-08-06 19:46:49" }, { "ioc_value": "https:\/\/github.com\/holasisisi23\/telegram-media-downloader\/raw\/refs\/heads\/main\/unnoticed\/media-telegram-downloader-unhatched.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:41", "last_seen": "2026-08-06 19:46:49" }, { "ioc_value": "http:\/\/45.202.241.21\/bins\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/83.168.95.167\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/193.233.113.85\/debug\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/193.233.113.85\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/150.40.126.53\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/83.217.209.80\/debug\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "https:\/\/github.com\/grere856-dot\/vigilant-waffle\/raw\/refs\/heads\/main\/loader.ps1", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/grere856-dot\/vigilant-waffle\/refs\/heads\/main\/loader.ps1", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/83.217.209.80\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/64.89.163.218\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/178.16.53.143:8080\/Loader.exe", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/176.65.149.138\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/89.190.156.61\/bins\/loader", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/lfwxgs.com\/debug\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "http:\/\/31.56.209.8\/bins\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "http:\/\/31.56.209.8\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "http:\/\/31.57.129.10:8000\/bins\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/simonizauto.com\/wp-includes\/fonts\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "http:\/\/194.32.248.126\/updates\/Microsoft%20Windows%20PnP%20Device%20Driver%20Loader.exe", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "http:\/\/31.57.129.10\/bins\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/tpkpolus.ru\/wp-content\/plugins\/dvgfltm\/aa\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/www.simonizauto.com\/wp-includes\/fonts\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "http:\/\/103.82.25.124\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "http:\/\/85.17.200.10\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/github.com\/mailrealfedex-svga\/uploader\/raw\/refs\/heads\/main\/finale.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:41", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/gitlab.com\/Hoangdepzaivcl\/ccc\/-\/raw\/main\/Loader.zip?ref_type=heads", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/github.com\/kanebstuart\/cs2-ExLoader\/releases\/download\/download\/Phantom.CS2.zip", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/github.com\/tiiisiet65-sudo\/adawcacaw\/raw\/refs\/heads\/main\/macOSx_Downloader.zip", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/198.98.55.166\/loader.exe", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/193.17.183.8\/loader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:41", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/qw4c12qqqqoepwq.com\/debug\/loader.sh?build=94dabb3c6bb6d13338b7dadcc1432c4a", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/160.191.243.187\/bins\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/194.36.88.178\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:45", "last_seen": "2026-08-06 19:46:45" }, { "ioc_value": "https:\/\/ghost-loader.com\/downloads\/ghost.rar", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:45", "last_seen": "2026-08-06 19:46:45" }, { "ioc_value": "http:\/\/185.227.108.232\/bins\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:45", "last_seen": "2026-08-06 19:46:45" }, { "ioc_value": "https:\/\/rcqwr12c541wa421q.com\/debug\/loader.sh?build=4255a2023db4a285d45efb4aeedd4897", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Abi204050-web\/ELM\/main\/src\/dataloaders\/data_representation\/Software_v3.0-alpha.2.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/217.60.195.155\/Loader.apk", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/85.192.40.43\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Fardin187\/pixiv-downloader\/main\/common\/downloader_pixiv_1.0-beta.4.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/carlos0023\/gallery-dl-multi-instance-downloader\/main\/unpiteousness\/instance_gallery_downloader_multi_dl_1.6.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Gaming12325\/jiamu-skills\/main\/video-downloader\/scripts\/skills_jiamu_3.3.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/emann0\/YouTube-MP3-MP4-Downloader\/main\/public\/M_You_Downloader_Tube_1.6.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/FFR31MMRDyukikaze\/ASPX_WebShell_COFFLoader\/master\/violetwise\/Web-ASP-COFF-Loader-Shell-v1.0.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Overhand-cool515\/loader-openclaw-skills\/main\/yodeler\/loader_openclaw_skills_2.9.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/explosive-purpleloco533\/TweaksLoader\/main\/fennish\/Tweaks_Loader_1.8.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/junctiontransistorselffertilisation783\/phoenix-downloader\/main\/tests\/downloader_phoenix_1.9.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/hitesh9624\/YouTube-Playlist-Downloader\/main\/Casuariidae\/Playlist-You-Downloader-Tube-1.3.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/tawaz15\/Nexus-Archive-Downloader\/main\/assets\/Nexus_Archive_Downloader_3.9.zip", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:43", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/EngerING\/RemoteDownloaderPHP\/main\/reviewal\/Downloader_Remote_PHP_3.5.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/vanguarddesign\/rekordbox-spotify-downloader\/main\/examples\/rekordbox-spotify-downloader-2.4.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/ashiandd\/arsenal-ng\/main\/internal\/loader\/cheat-files\/ng_arsenal_2.8-alpha.4.zip", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:43", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Juraiyah\/smugmug-bulk-downloader\/main\/timberland\/downloader_bulk_smugmug_3.0.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Asfand-Khann\/YoutubeDownloader\/main\/dilatedness\/Downloader-Youtube-2.5.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/baleyroy88\/unlimited-kodi-downloader-download-audio-video-image-easily\/main\/Arverni\/downloader_image_download_unlimited_kodi_audio_video_easily_v2.8.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:43" }, { "ioc_value": "http:\/\/45.76.149.237\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/5v12-3my5908y1.com\/debug\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/KUpals001\/youtube-downloader\/main\/app\/api\/youtube-downloader-v3.7.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "http:\/\/93.115.101.146:13734\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "http:\/\/2.26.75.58\/debug\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:41", "last_seen": "2026-08-06 19:46:41" }, { "ioc_value": "http:\/\/2.26.75.58\/loader.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:41", "last_seen": "2026-08-06 19:46:41" }, { "ioc_value": "http:\/\/ecl80.cfd:8080\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/nmcdn.info\/NMLoader%20v%204.2.1.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/nightmare-cheats.vip\/NMLoader%20v%204.2.1.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/exptersed.com\/debug\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/nightmare-download.pw\/NMLoader%20v%204.2.1.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/skript.club\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "http:\/\/lcd88.cfd\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "http:\/\/178.16.54.109\/loader_domain.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "http:\/\/178.16.54.109\/loader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "http:\/\/ths.lat\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "http:\/\/pvphood.cc\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "http:\/\/151.242.30.40\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "https:\/\/tpkpolus.ru\/wp-content\/plugins\/dvgfltm\/onelife\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "http:\/\/209.99.186.235\/api\/agent\/loader?k=n4d-2ff16c75b1d2", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "http:\/\/cdnorigin.net\/api\/agent\/loader?k=n4d-2ff16c75b1d2", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "http:\/\/192.159.99.131:8080\/loader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "http:\/\/tpkpolus.ru\/wp-content\/plugins\/dvgfltm\/onelife\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "http:\/\/164.215.103.113:6996\/pikujyhtcxz\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "http:\/\/185.139.214.200\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:38" }, { "ioc_value": "http:\/\/91.92.40.18:8081\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:36", "last_seen": "2026-08-06 19:46:37" }, { "ioc_value": "http:\/\/eclipsebible.com\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:37" }, { "ioc_value": "http:\/\/51.75.118.165\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:37" }, { "ioc_value": "http:\/\/95.164.53.73\/loader.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-06 19:46:37" }, { "ioc_value": "apps-loader.netlify.app", "ioc_type": "other", "category": "Cryptocurrency", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 14:41:32", "last_seen": "2026-08-06 14:48:58" }, { "ioc_value": "app-loader.netlify.app", "ioc_type": "other", "category": "Cryptocurrency", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 14:41:32", "last_seen": "2026-08-06 14:48:58" }, { "ioc_value": "uploader.irys.xyz", "ioc_type": "other", "category": "Cryptocurrency", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:08:59", "last_seen": "2026-08-06 14:48:54" }, { "ioc_value": "vscophotodownloader.com", "ioc_type": "other", "category": "Cryptocurrency", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:08:49", "last_seen": "2026-08-06 14:48:41" }, { "ioc_value": "https:\/\/www.splunk.com\/en_us\/blog\/security\/enter-the-gates-an-analysis-of-the-darkgate-autoit-loader.html", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-06 14:48:31" }, { "ioc_value": "https:\/\/www.sentinelone.com\/labs\/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/news.sophos.com\/en-us\/2021\/03\/01\/gootloader-expands-its-payload-delivery-options\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.zscaler.com\/blogs\/security-research\/squirrelwaffle-new-loader-delivering-cobalt-strike", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.netskope.com\/blog\/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/tracking-oceanlotus-new-downloader-kerrdown\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/socket.dev\/blog\/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/threatresearch.ext.hp.com\/svcready-a-new-loader-reveals-itself\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.welivesecurity.com\/en\/eset-research\/oilrig-persistent-attacks-cloud-service-powered-downloaders\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/symantec-enterprise-blogs.security.com\/blogs\/threat-intelligence\/bumblebee-loader-cybercrime", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/blog.morphisec.com\/revealing-the-snip3-crypter-a-highly-evasive-rat-loader", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/threatpost.com\/spammers-revive-hancitor-downloader-campaigns\/123011\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/guloader-installing-netwire-rat\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/elis531989.medium.com\/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/blogs.jpcert.or.jp\/en\/2019\/09\/tscookie-loader.html", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/blog.malwarebytes.com\/threat-intelligence\/2021\/04\/a-deep-dive-into-saint-bot-downloader\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/securelist.com\/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign\/101519\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.malwaretech.com\/2013\/08\/powerloader-injection-something-truly.html", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.welivesecurity.com\/2013\/03\/19\/gapz-and-redyms-droppers-based-on-power-loader-code\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/08\/smoke-loader-downloader-with-a-smokescreen-still-alive\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/socket.dev\/blog\/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.acronis.com\/en-us\/cyber-protection-center\/posts\/trojan-as-a-service-from-formbook-to-xloader\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/research.checkpoint.com\/2022\/xloader-botnet-find-me-if-you-can\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/any.run\/cybersecurity-blog\/xloader-formbook-encryption-analysis-and-malware-decryption\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.kroll.com\/en\/insights\/publications\/cyber\/idatloader-distribution", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/seguranca-informatica.pt\/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.zscaler.com\/blogs\/security-research\/technical-analysis-xloader-versions-6-and-7-part-1", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.virusbulletin.com\/conference\/vb2023\/abstracts\/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.pwc.com\/gx\/en\/issues\/cybersecurity\/cyber-threat-intelligence\/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:29" }, { "ioc_value": "https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/ta416-goes-ground-and-returns-golang-plugx-malware-loader", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:29" }, { "ioc_value": "https:\/\/www.secureworks.com\/research\/bronze-starlight-ransomware-operations-use-hui-loader", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 8, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:29" }, { "ioc_value": "downloader.re58.cn", "ioc_type": "other", "category": "C2 Attribution", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:09:25", "last_seen": "2026-08-06 14:48:07" }, { "ioc_value": "activation.downloader.city", "ioc_type": "other", "category": "Phishing", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:08:11", "last_seen": "2026-08-06 14:47:32" }, { "ioc_value": "2019-file-download-service-pdf-downloader.azurewebsites.net", "ioc_type": "other", "category": "Phishing", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:08:05", "last_seen": "2026-08-06 14:47:25" }, { "ioc_value": "https:\/\/www.recordedfuture.com\/research\/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.cyber.nj.gov\/alerts-advisories\/gootloader-malware-platform-uses-sophisticated-techniques-to-deliver-malware", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/blogs.blackberry.com\/en\/2022\/07\/gootloader-from-seo-poisoning-to-multi-stage-downloader", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "FlawedAmmyy.downloader", "ioc_type": "other", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/quant-loader-is-now-bundled-with-other-crappy-malware\/", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/blogs.forcepoint.com\/security-labs\/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.malwarebytes.com\/blog\/threat-intelligence\/2022\/04\/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/objective-see.com\/blog\/blog_0x25.html#MacDownloader", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/malpedia.caad.fkie.fraunhofer.de\/details\/win.romulus_loader", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/malpedia.caad.fkie.fraunhofer.de\/details\/win.silent_run_loader", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.solvusoft.com\/en\/malware\/trojans\/downloader-fgo\/", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "Downloader.APT.HAPPYWORK", "ioc_type": "other", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "APT.Downloader.SLOWDRIFT", "ioc_type": "other", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/10-things-i-hate-about-attribution-romcom-vs-transferloader", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/blog.jpcert.or.jp\/2018\/06\/plead-downloader-used-by-blacktech.html", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.recordedfuture.com\/research\/graybravos-castleloader-activity-clusters-target-multiple-industries", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.recordedfuture.com\/research\/from-castleloader-to-castlerat-tag-150-advances-operations", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.virusbulletin.com\/blog\/2019\/02\/malspam-security-products-miss-banking-and-email-phishing-emotet-and-bushaloader\/", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/blog.talosintelligence.com\/2019\/02\/combing-through-brushaloader.html", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/blog.talosintelligence.com\/2019\/04\/jasperloader-targets-italy.html?m=1", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/r136a1.dev\/2026\/01\/14\/command-and-evade-turlas-kazuar-v3-loader\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:12:59", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.welivesecurity.com\/2019\/11\/21\/deprimon-default-print-monitor-malicious-downloader\/", "ioc_type": "url", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/blog.sonicwall.com\/en-us\/2024\/01\/blackwood-apt-group-has-a-new-dll-loader\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.secureworks.com\/research\/bronz-vinewood-uses-hanaloader-to-target-government-supply-chain", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.mandiant.com\/resources\/blog\/tracking-evolution-gootloader-operations", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socradar.io\/new-gootloader-variant-gootbot-changes-the-game-in-malware-tactics\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/securityintelligence.com\/x-force\/gootbot-gootloaders-new-approach-to-post-exploitation\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/iranthreats.github.io\/resources\/macdownloader-macos-malware\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:12:59", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socprime.com\/blog\/uac-0057-attack-detection-a-surge-in-adversary-activity-distributing-picassoloader-and-cobalt-strike-beacon\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socprime.com\/blog\/picassoloader-and-cobalt-strike-beacon-detection-uac-0057-aka-ghostwriter-hacking-group-attacks-the-ukrainian-leading-military-educational-institution\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/18\/k\/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/18\/d\/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing.html", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.microsoft.com\/en-us\/security\/blog\/2024\/12\/04\/frequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:12:59", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/jssloader-recoded-and-reloaded", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.zscaler.com\/blogs\/security-research\/european-diplomats-targeted-spikedwine-wineloader", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socprime.com\/blog\/smokeloader-detection-uac-0006-group-launches-a-new-phishing-campaign-against-ukraine\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socprime.com\/blog\/smokeloader-malware-detection-uac-0006-hackers-launch-a-wave-of-phishing-attacks-against-ukraine-targeting-accountants\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socprime.com\/blog\/detecting-smokeloader-campaign-uac-0006-keep-targeting-ukrainian-financial-institutions-in-a-series-of-phishing-attacks\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socprime.com\/blog\/latest-threats\/detect-smokeloader-malware-uac-0006-strikes-again-to-target-ukraine-in-a-series-of-phishing-attacks\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/socprime.com\/blog\/smokeloader-malware-detection-uac-0006-group-reemerges-to-launch-phishing-attacks-against-ukraine-using-financial-subject-lures\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.facct.ru\/blog\/phantomdl-loader", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.microsoft.com\/en-us\/security\/blog\/2024\/12\/11\/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/security-brief-ta571-delivers-icedid-forked-loader", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/brushaloader-still-sweeping-victims-one-year-later", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.esentire.com\/blog\/phantomcontrol-returns-with-ande-loader-and-swaetrat", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "loader.plg", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:11", "last_seen": "2026-08-06 14:43:53" }, { "ioc_value": "https:\/\/www.zscaler.com\/blogs\/security-research\/nodeloader-exposed-node-js-malware-evading-detection", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:10", "last_seen": "2026-08-06 14:43:52" }, { "ioc_value": "https:\/\/blog.sekoia.io\/webdav-as-a-service-uncovering-the-infrastructure-behind-emmenhtal-loader-distribution\/", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:10", "last_seen": "2026-08-06 14:43:52" }, { "ioc_value": "memoriumloader.lol", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:10", "last_seen": "2026-08-06 14:43:52" }, { "ioc_value": "https:\/\/threatfox.abuse.ch\/browse\/malware\/win.empire_downloader\/", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:10", "last_seen": "2026-08-06 14:43:51" }, { "ioc_value": "shellloader.top", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:10", "last_seen": "2026-08-06 14:43:51" }, { "ioc_value": "kms-pi-co-downloader.com", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:09", "last_seen": "2026-08-06 14:43:50" }, { "ioc_value": "kms-pi-co-downloader.org", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:09", "last_seen": "2026-08-06 14:43:50" }, { "ioc_value": "https:\/\/research.checkpoint.com\/2023\/unveiling-the-shadows-the-dark-alliance-between-guloader-and-remcos\/", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:09", "last_seen": "2026-08-06 14:43:50" }, { "ioc_value": "https:\/\/www.fortinet.com\/blog\/threat-research\/smokeloader-using-old-vulnerabilities", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:09", "last_seen": "2026-08-06 14:43:50" }, { "ioc_value": "https:\/\/research.checkpoint.com\/2022\/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk\/", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:09", "last_seen": "2026-08-06 14:43:49" }, { "ioc_value": "https:\/\/malwarebreakdown.com\/2017\/07\/24\/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc\/", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:08", "last_seen": "2026-08-06 14:43:48" }, { "ioc_value": "curly-bar-8ce5.myloaders.workers.dev", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:08", "last_seen": "2026-08-06 14:43:48" }, { "ioc_value": "young-bonus-b8e4.myloaders.workers.dev", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:08", "last_seen": "2026-08-06 14:43:48" }, { "ioc_value": "Doc.Downloader.Powload", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:07", "last_seen": "2026-08-06 14:43:47" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/analysis-of-smoke-loader-in-new-tsunami-campaign\/", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:11:07", "last_seen": "2026-08-06 14:43:47" }, { "ioc_value": "tiktokdownloader.fr", "ioc_type": "other", "category": "Ransomware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:10:23", "last_seen": "2026-08-06 14:43:04" }, { "ioc_value": "youtubedownloader.fr", "ioc_type": "other", "category": "Ransomware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:10:22", "last_seen": "2026-08-06 14:43:03" }, { "ioc_value": "auto-loader.org", "ioc_type": "other", "category": "Malware Domains", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:37", "last_seen": "2026-08-06 14:42:14" }, { "ioc_value": "api.samp-loader.ru", "ioc_type": "other", "category": "Malware Domains", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:35", "last_seen": "2026-08-06 14:42:12" }, { "ioc_value": "app-loader-suite.com", "ioc_type": "other", "category": "Malware Domains", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:35", "last_seen": "2026-08-06 14:42:12" }, { "ioc_value": "a.get-mac-downloader.com", "ioc_type": "other", "category": "Malware Domains", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:33", "last_seen": "2026-08-06 14:42:09" }, { "ioc_value": "access.samp-loader.ru", "ioc_type": "other", "category": "Malware Domains", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:32", "last_seen": "2026-08-06 14:42:08" }, { "ioc_value": "7.fs-loader.com", "ioc_type": "other", "category": "Malware Domains", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:31", "last_seen": "2026-08-06 14:42:07" }, { "ioc_value": "https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy\/", "ioc_type": "url", "category": "Mobile ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:20", "last_seen": "2026-08-06 14:41:54" }, { "ioc_value": "https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing\/", "ioc_type": "url", "category": "Mobile ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:20", "last_seen": "2026-08-06 14:41:54" }, { "ioc_value": "asd.my-downloader.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:41", "last_seen": "2026-08-06 14:41:09" }, { "ioc_value": "asloader.tz.de", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:41", "last_seen": "2026-08-06 14:41:09" }, { "ioc_value": "6.content-loader.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:35", "last_seen": "2026-08-06 14:41:01" }, { "ioc_value": "5.content-loader.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:35", "last_seen": "2026-08-06 14:41:00" }, { "ioc_value": "movieloader.net", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 14:40:55", "last_seen": "2026-08-06 14:40:55" }, { "ioc_value": "soundclouddownloader.info", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "uploaderonline.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 14:40:54", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "youtubedownloaderfree.net", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "premiumuploader.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "fileuploader.info", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "topuploader.net", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "uploaders.biz", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "megauploaders.net", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "firstuploader.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:08:27", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "greatuploader.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 14:40:54", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "pcgamesdownloader.com", "ioc_type": "other", "category": "Scam", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 14:40:54", "last_seen": "2026-08-06 14:40:54" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/25\/d\/fog-ransomware-concealed-within-binary-loaders-linking-themselve.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.lastline.com\/labsblog\/nemty-ransomware-scaling-up-apac-mailboxes-swarmed-dual-downloaders\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.guidepointsecurity.com\/from-zloader-to-darkside-a-ransomware-story\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/0x00-0x7f.github.io\/Netwalker-from-Powershell-reflective-loader-to-injected-Dll\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/research.nccgroup.com\/2022\/04\/29\/adventures-in-the-land-of-bumblebee-a-new-malicious-loader\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/thedfirreport.com\/2021\/09\/13\/bazarloader-to-conti-ransomware-in-32-hours\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/thedfirreport.com\/2021\/10\/04\/bazarloader-and-the-conti-leaks\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/intel471.com\/blog\/privateloader-malware", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/d\/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload\/iocs-thwarting-loaders-socgholish-blister.txt", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_no\/research\/22\/d\/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/22\/d\/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "http:\/\/phishme.com\/rockloader-downloading-new-ransomware-bart\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.microsoft.com\/security\/blog\/2022\/04\/13\/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/22\/g\/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "Downloader.Pony", "ioc_type": "other", "category": "C2 Certificates", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:11:43", "last_seen": "2026-08-06 13:11:43" }, { "ioc_value": "Downloader.AuotIT.ZLIB", "ioc_type": "other", "category": "C2 Certificates", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:11:43", "last_seen": "2026-08-06 13:11:43" }, { "ioc_value": "https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/libloaderapi\/nf-libloaderapi-loadlibrarya", "ioc_type": "url", "category": "ICS ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:09:23", "last_seen": "2026-08-06 13:09:23" }, { "ioc_value": "facebook-downloader.czhyk.biz.id", "ioc_type": "other", "category": "Phishing", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:08:25", "last_seen": "2026-08-06 13:08:25" }, { "ioc_value": "https:\/\/tobecation.github.io\/TSL\/downloader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/tacocat2222\/materia-fivem\/refs\/heads\/main\/loader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Da2dalus\/The-MALWARE-Repo\/master\/Banking-Malware\/Zloader.xlsm", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/github.com\/yogeshnicks\/loader-ldtk\/releases\/download\/v2.0\/Software.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "http:\/\/www.newkey.co.kr\/cab\/LauncherLoader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Erez-Goldberg\/js-file-test\/main\/loader.js", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/LeakerByDragon1\/LeakerByDragon1\/main\/loader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/Rookievip\/xx\/main\/Loader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/github.com\/trasherwithadollarsign\/Trashers-Malware-Repo\/raw\/main\/Trojan\/FreeYoutubeDownloader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/github.com\/dis3j\/wagnerhook\/releases\/download\/Release\/Loader.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/keygroup777-ransomware\/downloader\/refs\/heads\/main\/taskmoder.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/keygroup777-Ransomware\/DOWNLOADER\/refs\/heads\/main\/cssgo.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" }, { "ioc_value": "http:\/\/github.com\/keygroup777-Ransomware\/DOWNLOADER\/raw\/refs\/heads\/main\/black.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-06 13:07:42" } ] }