SecuriTricks - loader

New Loader Executing TorNet and PureHVNC

A new malware loader discovered in May 2025 executes two malware families: TorNet and PureHVNC. The loader uses API hashing with MurmurHash2 and implements persistence through registry modifications. It decrypts and decompresses payloads using AES-128-ECB and LZMA, then injects them into a suspende…

loader

purehvnc

Published: October 31, 2025

Downloadable IOCs: 0

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | Trend Micro (US)

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more…

Published: October 6, 2025

Downloadable IOCs: 23

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.)

The report analyzes a campaign where threat actors distribute various malware strains like RATs, coinminers, and loaders disguised as cracked versions of popular software. South Korean systems are heavily targeted, with malware persisting via scheduled tasks and evading security products. Detailed …

Published: May 30, 2024

Downloadable IOCs: 11

New Hijack Loader Variant: Uses Process Hollowing, Has Enhanced Anti-Evasion Capabilities

Published: May 23, 2024

Downloadable IOCs: 9

D3F@ck Loader, the New MaaS Loader

In March 2024, eSentire's Threat Response Unit (TRU) discovered multiple instances of D3F@ck Loader infections being propagated via Google Ads. This new loader, which debuted on hacking forums in January 2024 (Figure 1), can allegedly bypass several key security features such as Google Chrome, Edge…

Published: May 21, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 3

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

LATRODECTUS is a malware loader gaining popularity among cybercriminals, with strong connections to the ICEDID malware family. It offers standard capabilities for deploying payloads and conducting post-exploitation activities. Initially discovered by Walmart researchers in 2023, it continues evolvi…

financially-motivated

Published: May 17, 2024

Downloadable IOCs: 7

Code Emulation and Cybercrime Infrastructure Discovery

This report details the analysis of a malspam campaign utilizing the Matanbuchus loader, which involved decrypting strings within the malware through emulation techniques. The investigation pivoted to uncover a Russian bulletproof hosting service, Proton66 OOO, that currently hosts various maliciou…

Published: May 8, 2024

Downloadable IOCs: 76

Tag: loader

Attack reports

New Loader Executing TorNet and PureHVNC

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | Trend Micro (US)

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users

Olymp Loader: A new Malware-as-a-Service written in Assembly

Two sides of the same coin

Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

BabbleLoader

Hello again, FakeBat: popular loader returns after months-long hiatus

New wave of Bumblebee malware attacks warned

New Bumblebee Loader Infection Chain Signals Possible Resurgence

HijackLoader evolution: abusing genuine signing certificates

Core Werewolf hones its arsenal against Russia’s government organizations

Arsenal honed against Russia's government organizations

Wreaking havoc in cyberspace: threat actors experiment with pentest tools

Cuckoo Threat Actor Arsenal

Loki: a new private agent for the popular Mythic framework

Exploring the D3F@ck Malware-as-a-Service Loader

Ande Loader Leads to 0bj3ctivity Stealer Infection

A Dive into Latest Campaign

DodgeBox: A deep dive into the updated arsenal of APT41

Exposing FakeBat loader: distribution methods and adversary infrastructure

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.)

New Hijack Loader Variant: Uses Process Hollowing, Has Enhanced Anti-Evasion Capabilities

D3F@ck Loader, the New MaaS Loader

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

Code Emulation and Cybercrime Infrastructure Discovery