ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis targets the execution of known IOCs associated with the “Unknown Loader,” a mechanism adversaries use to establish initial footholds or stage payloads within Azure environments. Proactively hunting for these indicators allows the SOC to identify compromised workloads or identity theft vectors before they progress to lateral movement or data exfiltration.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 6 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["bitfundedxcryptobanter.com", "butecoemcasacampinas.com.br", "clinicaveterinarialescampes.com", "deshrxpharmacy.com", "radiology-technician.com", "thefestivevillas.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

• Scenario: A DevOps engineer uses Ansible or Terraform to deploy a new microservice, where the deployment script downloads a binary loader from a public GitHub repository (e.g., github.com/unknown-loader/...) to the build agent. The IOC matches the SHA256 or URL of the downloaded artifact.
  • Filter/Exclusion: Exclude processes where the parent process is ansible-playbook.exe or terraform.exe, and the file path contains \.terraform\ or ansible\cache\. Alternatively, whitelist the specific GitHub URL if it is a known internal mirror.
• Scenario: The IT team deploys a new version of CrowdStrike Falcon or Carbon Black agent via SCCM (System Center Configuration Manager). The installer package contains a staging loader binary that matches one of the 6 IOCs (often a generic name like loader.exe or a specific hash used in the packaging).
  • Filter/Exclusion: Exclude files located in C:\Program Files\CrowdStrike\ or C:\Program Files\Carbon Black\ where the parent process is CCMEXEC.EXE or CCMEXEC32.EXE. Also, exclude if the file is signed by “CrowdStrike, Inc.” or “Carbon Black, Inc.”
• Scenario: A database administrator runs a scheduled SQL Server Agent Job that executes a stored procedure to call an external Python script for data archival. The Python script uses a virtual environment (venv) that includes a pip-installed package with a native loader component matching the IOC.
  • Filter/Exclusion: Exclude processes where the parent process is sqlagent.exe or python.exe and the file path contains venv\ or site-packages\. Whitelist the specific hash if the