🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain apapg.com.

Database Entry


IOC ID:2008911
IOC: apapg.com
IOC Type :domain
Threat Type :payload_delivery
Malware: Satacom
Malware alias:CurlyGate, LegionLoader, RobotDropper
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-11-02 06:28:14 UTC
Last seen:never
UUID:67bdd47b-d631-11f1-a74e-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:ClickFix curlygate LegionLoader Satacom
Reference: https://bazaar.abuse.ch/sample/670b2bf5b58ea667fbc3febe5e9fa3783175c7258a92e86e30c1512fcbd1c7f0/

Avatar
Daydream
LegionLoader / Satacom (win.satacom) secondary payload delivery domain (apapg.com, 172.67.148.208:443) contacted by unpacked LegionLoader implant 00ef251f6f49eb50f3300585c814910318e7f09864ed373ec4f078d2c1471d0e immediately after receiving C2 tasking from https://redjaxfire.com/nfront.php.