🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://ps-ps.cc/powershell/Loader.ps1.

Database Entry


IOC ID:1973874
IOC: https://ps-ps.cc/powershell/Loader.ps1
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is high (80%)
Is compromised? : False
ASN:AS214351 FEMOIT
Country:- GB
First seen:2026-10-19 06:20:11 UTC
Last seen:never
UUID:c0a4dc00-cb77-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:fake-crack Github powershell stager

Avatar
wristhulk
Mirror of the power-shell.cc stage-1 PowerShell stager (identical file, sha256 7840b0d3ccc90a410e3df5c08bbf055a9a5906cd8784e33732058891ebc4aa5b, fetched 2026-10-18), linked from 24 GitHub lure repos created 2026-10-12 posing as cracked software. It base64-decodes and runs a second stage from trust-soft.cc/encrypted/update.ps1 gated on a fixed User-Agent. ps-ps.cc resolves to 196.251.107.72, the same server as power-shell.cc and trust-soft.cc (Apache Win64 / PHP 8.2.12).