ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hunt targets the presence of five specific IOCs linked to an unknown loader, indicating a potential initial access or execution mechanism that may be used to establish a foothold in the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the loader can deploy additional payloads or escalate privileges.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 5 IOC Types: url, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://91[.]92[.]43[.]245/`	payload_delivery	2026-09-25	100%
url	`hxxp://puytrewdv.com`	payload_delivery	2026-09-25	100%
url	`hxxps://pub-22c5fb19472741eba9206c96fcd10f9c.r2.dev`	payload_delivery	2026-09-25	100%
url	`hxxps://lucciodontologiaintegrada.com.br/16/zong.ps1`	payload_delivery	2026-09-25	50%
sha256_hash	`597e1f47936b2dc91df74e9769273a62730043b835e260c77950672db2c5b009`	payload	2026-09-25	85%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["http://91.92.43.245/", "http://puytrewdv.com", "https://pub-22c5fb19472741eba9206c96fcd10f9c.r2.dev", "https://lucciodontologiaintegrada.com.br/16/zong.ps1"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["597e1f47936b2dc91df74e9769273a62730043b835e260c77950672db2c5b009"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown Loader

False Positive Guidance

Scenario: A DevOps engineer uses curl or wget to download a specific build artifact or dependency package from a private artifact repository (e.g., Artifactory, Nexus) that happens to share a hash or URL pattern with one of the 5 IOCs.
- Filter/Exclusion: Exclude alerts where the source IP is within the internal CIDR range for the build farm or where the process parent is docker, kubectl, or helm.
Scenario: An IT administrator performs a manual software update for a niche enterprise application (e.g., a specific version of Adobe Creative Cloud or a proprietary EDR agent) where the installer executable matches one of the known IOCs due to a shared code signature or file hash.
- Filter/Exclusion: Exclude alerts where the executable path contains standard installation directories (e.g., C:\Program Files\, C:\ProgramData\) and the process name matches the known application name (e.g., setup.exe, installer.exe).
Scenario: A scheduled maintenance job runs a custom PowerShell script to clean up temporary files or rotate logs, and the script downloads a small utility or configuration file from an internal web server that matches an IOC URL or hash.
- Filter/Exclusion: Exclude alerts where the initiating process is powershell.exe or pwsh.exe and the parent process is svchost.exe (indicating a scheduled task) or taskeng.exe, and the destination path is within a known temp or log directory (e.g., C:\Temp\, C:\Logs\).
Scenario: A security team runs a YARA scan or memory dump analysis using a tool like Volatility or YARA that includes a rule or module with a hash matching one of the IOCs, triggering the detection during routine threat hunting or