Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
2CLoader Uses Hell’s Gate Syscalls and Windows API Hooks to Deliver Vidar and Remus
Malware Families
Excerpt
ThreatLabz has identified a new Windows malware loader called 2CLoader, which has been used to deliver the Vidar and Remus information stealers, as well as the XWorm remote-access Trojan. Researchers observed the loader in August 2026 and found that it combines encrypted payloads, anti-analysis checks, indirect system calls, and Windows API hooks to evade security tools. The loader is highly configurable and can support different payload execution, persistence, and…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 5edcaa75a28e5cd700bf7643b275fe5d28649aa41a0711f391ec1fca795a4e8a | Medium | Score 53/100 | First seen |
| SHA256 | 0017821181723261801e24abb9d33c739f382889d46dbf46d320c87ac62e5ca6 | High | Score 85/100 | First seen |
IOC Relationship Graph
Building graph…