HijackLoader
1New IOCs · 24h
13New IOCs · 7 days
26Indicators tracked
3Independent feeds
2026-10-11 18:27Last activity
New indicators per day
2026-09-29 to 2026-10-12, by first report.
- Hash10
- URL2
- TLS cert13
- IP1
- Malware12
- C214
Where its infrastructure is hosted
Latest indicators
Filter the live feed →| First seen | Type | Indicator | Role | Where |
|---|---|---|---|---|
| 2026-10-11 18:27 | URL | hxxps://getoutofthebackseat[.]com/HashManager64.zip | Payload delivery | — |
| 2026-10-11 07:02 | SHA256 | 13608aa205e934e3e0b3ac504e1589a41285f9197f6f53be01c2bc59f46b6837 | payload | — |
| 2026-10-11 07:02 | SHA256 | ad7ae1df63dc9f6ee4eabbeb4e9c0f98b2a1b1d69ad8bde9b564e998678310c4 | payload | — |
| 2026-10-11 07:02 | SHA256 | 4323fb90e50b2deb5f9fd235100dd7e41e28f1fd645099dc3bc65e1445463613 | payload | — |
| 2026-10-11 07:02 | SHA256 | 82cfa13c5614b24832b396034fdf907a009ab9a9c7a8c77ddc39b66bc66c90d0 | payload | — |
| 2026-10-06 19:25 | MD5 | 212d6f0d9e544c346f8dae39d0acd06d | payload | — |
| 2026-10-06 19:25 | SHA256 | 11e50f88499ead9da9d4b0b6c062651181f28df1bf1078c5d69bdf55a836b370 | payload | — |
| 2026-10-06 19:25 | SHA1 | 5b84c04a9c2f24d7eb911b452b1d4db045db0f82 | payload | — |
| 2026-10-06 05:28 | URL | hxxps://ohhhhhmoney[.]com/fF2 | Payload delivery | — |
| 2026-10-05 18:46 | SHA256 | fcc68fa324c98554b43c87798b630a81ed2a6df24387a9a0ab3b798f4ac9b66c | payload | — |
| 2026-10-05 18:01 | IP | 207.246.98[.]204:3333 | Botnet C2 | — |
| 2026-10-05 17:52 | SHA256 | 1c7307d4c302f8df999d6ad02020a047739ea65a565513a696b3e7765affd633 | Malware sample | — |
| 2026-10-05 17:34 | SHA256 | 11e50f88499ead9da9d4b0b6c062651181f28df1bf1078c5d69bdf55a836b370 | Malware sample | — |
| 2026-06-06 06:28 | TLS cert | d913080ef794a3bb0a60e395bfd72c00cc4712ac | Botnet C2 | — |
| 2025-11-03 10:19 | TLS cert | 4f65a24caf2530cee4093f889f3a70f8860985c3 | Botnet C2 | — |
| 2025-10-10 08:25 | TLS cert | 87b867f7bb1bcd5cad648594d99ec09ebd7da0f3 | Botnet C2 | — |
| 2025-10-01 10:13 | TLS cert | 13ba2f1db866f43e69ee2d8ee7e3375e7c684604 | Botnet C2 | — |
| 2025-09-27 13:21 | TLS cert | 82d2a5a4761ee59c2f38652fb474c93be2e54e9a | Botnet C2 | — |
| 2025-09-19 07:56 | TLS cert | ecbe3368e24d0db73606809e68a27caff5c60d1e | Botnet C2 | — |
| 2025-09-12 06:50 | TLS cert | 5a105d1b237bf73a101db684f5beb88b5497222c | Botnet C2 | — |
| 2025-09-08 06:36 | TLS cert | 300576b819cae054d40e423abf53a7b220c57edd | Botnet C2 | — |
| 2025-08-17 13:11 | TLS cert | 3ada88e9fb96eac60e684ed49de79748794d3676 | Botnet C2 | — |
| 2025-08-04 08:38 | TLS cert | c4b4257bce5e78b2d2af5e42b234d3fa88449a43 | Botnet C2 | — |
| 2025-08-03 16:00 | TLS cert | aba9933a686107f25fbb65de190f347b880496f8 | Botnet C2 | — |
| 2025-07-29 14:17 | TLS cert | ef8a914461bdad0611e28f12d5c124259f7b467a | Botnet C2 | — |
| 2025-06-25 06:50 | TLS cert | 029c128ec7f6c5a62ea19f5ad525cd1487971ce4 | Botnet C2 | — |
Defanged for safety. URL query strings removed.