This hypothesis targets the execution of known “Unknown Loader” binaries, which adversaries deploy to establish persistence and facilitate further payload delivery within the environment. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the loader can fully establish a foothold or trigger subsequent malicious activities.
Malware Family: Unknown Loader Total IOCs: 121 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | yellowboximmigration.com | payload_delivery | 2026-09-24 | 75% |
| domain | youngpropertypartners.com | payload_delivery | 2026-09-24 | 75% |
| domain | yrmok.com | payload_delivery | 2026-09-24 | 75% |
| domain | zaminu.com | payload_delivery | 2026-09-24 | 75% |
| domain | zaura.cy | payload_delivery | 2026-09-24 | 75% |
| domain | zofia.co.za | payload_delivery | 2026-09-24 | 75% |
| domain | zomnotho.org.za | payload_delivery | 2026-09-24 | 75% |
| domain | zwavhudianimalfeeds.co.za | payload_delivery | 2026-09-24 | 75% |
| domain | windoweaze.com | payload_delivery | 2026-09-24 | 75% |
| domain | wkupaachen.de | payload_delivery | 2026-09-24 | 75% |
| domain | wolfserviceco.hu | payload_delivery | 2026-09-24 | 75% |
| domain | wooshopapp.com | payload_delivery | 2026-09-24 | 75% |
| domain | worldbookies.org | payload_delivery | 2026-09-24 | 75% |
| domain | wvhindutemple.org | payload_delivery | 2026-09-24 | 75% |
| domain | www-reddybook.club | payload_delivery | 2026-09-24 | 75% |
| domain | x-airlsa.com | payload_delivery | 2026-09-24 | 75% |
| domain | x666gamee.com.pk | payload_delivery | 2026-09-24 | 75% |
| domain | xifinetworks.com | payload_delivery | 2026-09-24 | 75% |
| domain | xn----twfbm8fm7csmhb7drd2b9ctk4i0k.com | payload_delivery | 2026-09-24 | 75% |
| domain | xn--viasonrie-m6a.cl | payload_delivery | 2026-09-24 | 75% |
| domain | yas-news.net | payload_delivery | 2026-09-24 | 75% |
| domain | vzlastreaming.com | payload_delivery | 2026-09-24 | 75% |
| domain | wagyujc.com | payload_delivery | 2026-09-24 | 75% |
| domain | wajahsulsel.id | payload_delivery | 2026-09-24 | 75% |
| domain | walldecorstore.in | payload_delivery | 2026-09-24 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["yellowboximmigration.com", "youngpropertypartners.com", "yrmok.com", "zaminu.com", "zaura.cy", "zofia.co.za", "zomnotho.org.za", "zwavhudianimalfeeds.co.za", "windoweaze.com", "wkupaachen.de", "wolfserviceco.hu", "wooshopapp.com", "worldbookies.org", "wvhindutemple.org", "www-reddybook.club", "x-airlsa.com", "x666gamee.com.pk", "xifinetworks.com", "xn----twfbm8fm7csmhb7drd2b9ctk4i0k.com", "xn--viasonrie-m6a.cl", "yas-news.net", "vzlastreaming.com", "wagyujc.com", "wajahsulsel.id", "walldecorstore.in", "wandel-inge.nl", "wbhenterprises.com", "webenglishcenter.com", "webrapi.com", "weeklycitizen.co.ke", "wefixhailforfree.com", "wellbeingforhealth.com", "weltladen-aurich.de", "westzoneapp.com", "variideas.com", "vasitservis.cz", "verbainternat.com.ua", "versemua.com", "verzinoadventure.it", "victoriamoyle.com", "vidafit.fit", "vidracariakingglass.com.br", "villalesoliviers.fr", "violetfleur.com", "vivalaskinandlashes.com", "vlijmenseboys.nl", "vodanza.com", "vppolytechnic.org", "trustagainps.org", "tudosobrepnl.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy
7zS.sfx or a custom setup.exe) that has been historically associated with malware but is now standard in the enterprise.C:\Windows\Installer\ or C:\Program Files (x86)\[LegacyApp]\ AND the parent process is gpupdate.exe or msiexec.exe. Alternatively, whitelist the specific SHA256 hash of the known-good installer binary.Scheduled Backup Agent Execution
backup_loader.exe or agent_helper.dll) to initialize the backup session. This specific binary hash is included in the ThreatFox IOC list due to a past false positive report or a shared codebase with a known loader, triggering the alert during routine maintenance windows.*backup*loader* or *agent* AND the parent process is svchost.exe (specifically the LocalService or NetworkService instance) or a known backup service process (e.g., VeeamBackupSvc.exe).