{"type":"bundle","id":"bundle--46ef73fb-51e2-4c25-850e-f2ea69cdddac","objects":[{"type":"identity","spec_version":"2.1","id":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","created":"2026-09-16T13:18:01.793Z","modified":"2026-09-16T13:18:01.793Z","name":"ZeroHour","identity_class":"system","description":"Indicators auto-extracted from public security reporting. Verify before use."},{"type":"indicator","spec_version":"2.1","id":"indicator--a7ed90b0-2534-4206-9753-9d8d639a8150","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 252ca5e7b7c7fe237 Related sample: Tax_436454367.img SHA-256 0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d Related 2023 Chinese-language sample SHA-256 38ec1f5e23f65b","pattern":"[file:hashes.'SHA-256' = '0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1ffb474-0b9a-4877-8081-feef756bf16e","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: b679a73c2 Related sample: ClientAny.exe / skkr3.exe SHA-256 268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9 Related sample: Tax_Notice_16695 (1).img SHA-256 f23708ae47","pattern":"[file:hashes.'SHA-256' = '268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--849f6083-95bc-4ec2-8207-5a763c93b73a","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: e5a207315f7bf6ef74a966cbb5 libcurl.dll proxy loader SHA-256 2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec LIBCURL.DAT encrypted payload SHA-256 947221d0f1e2c9c090284","pattern":"[file:hashes.'SHA-256' = '2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fe239b3-2b00-4b35-8e83-b0a0a3af3fa1","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 860af2a6bd0f1d Related 2023 Chinese-language sample SHA-256 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c Related sample: Tax_Notice_23665.img SHA-256 a4098fe9ed421a","pattern":"[file:hashes.'SHA-256' = '38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e979d8b-18b7-4af2-ad1c-86869e6eed31","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 321927fea66d Builder certificate SHA-256 thumbprint SHA-256 72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2 Related sample: ClientAny.exe / skkr3.exe SHA-256 268a90d07","pattern":"[file:hashes.'SHA-256' = '72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--64ec4cee-81fc-4b7b-8687-3a4ea45a09fb","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 8eb192583f950c Tax_Notice_45594.exe signed launcher SHA-256 8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5 libcurl.dll proxy loader SHA-256 2ff898c1a4bb0dd48687bbbc8c","pattern":"[file:hashes.'SHA-256' = '8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d85f7a3-38d5-4ebe-9220-d81df4868bfe","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 80a49523dfbf9fb94a4ec LIBCURL.DAT encrypted payload SHA-256 947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f stage2.dll VenomRAT .NET DLL Install directory %APPDATA%\\Mi","pattern":"[file:hashes.'SHA-256' = '947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1932f2e7-8191-4c84-8fd9-6ea21e899647","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 7e44e6a998e04c Related sample: Tax_Notice_23665.img SHA-256 a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38 Related sample: Tax_Notice_99674.img Sister lure domain dgd","pattern":"[file:hashes.'SHA-256' = 'a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6363dcb8-0027-4243-9434-e8d9b62223b1","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: e4b10e65d0b08e3 Related sample: ITDENF2026-4281.img SHA-256 d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237 Related sample: Tax_436454367.img SHA-256 0c0e4935f8df04e86","pattern":"[file:hashes.'SHA-256' = 'd768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--18f98c70-6a03-404a-9a93-c53aad966b05","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 4c1299a8a9 Related sample: Tax_Notice_16695 (1).img SHA-256 f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3 Related sample: ITDENF2026-4281.img SHA-256 d768222934f6014","pattern":"[file:hashes.'SHA-256' = 'f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c6a9a4e-0f0c-4360-ba7e-8cb6eede6f22","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: ociated with the modified v6.0.3 builder SHA-256 thumbprint f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d Builder certificate SHA-256 thumbprint SHA-256 72a321802d73","pattern":"[file:hashes.'SHA-256' = 'f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2220116c-14e5-49ce-8e83-a687b0626bd1","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: {seq}} Unrendered variable in the From display name SHA-256 f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b Tax_Notice_45594.img ISO container SHA-256 fe0ddd8686324e0a","pattern":"[file:hashes.'SHA-256' = 'f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8204ee4-4502-41d1-be55-3a3e7d57873d","created":"2026-09-16T12:23:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c","description":"Seen in \"PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks\" (Cyber Security News). Context: 14ac8fe0f0c10d2b Tax_Notice_45594.img ISO container SHA-256 fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c Tax_Notice_45594.exe signed launcher SHA-256 8c1ba078598e09","pattern":"[file:hashes.'SHA-256' = 'fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c']","pattern_type":"stix","valid_from":"2026-09-16T12:23:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/papermill-hackers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c570a66e-a460-4a8b-9356-9f7b79fd3cf7","created":"2026-09-16T10:00:06.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9","description":"Seen in \"Atomic macOS (AMOS) Stealer Activity\" (Palo Alto Unit 42). Context: fection persistent on the infected macOS host SHA-256 hash: 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9 File size: 568,368 bytes File location: /Users/[username]/L","pattern":"[file:hashes.'SHA-256' = '4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9']","pattern_type":"stix","valid_from":"2026-09-16T10:00:06.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8093053e-c631-4250-98c6-0989015a390c","created":"2026-09-16T10:00:06.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688","description":"Seen in \"Atomic macOS (AMOS) Stealer Activity\" (Palo Alto Unit 42). Context: a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 . That Zsh script contains Base64-encoded text for a GZIP-c","pattern":"[file:hashes.'SHA-256' = '608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688']","pattern_type":"stix","valid_from":"2026-09-16T10:00:06.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2a6afb2-2d25-4d65-ae48-527903c3e854","created":"2026-09-16T10:00:06.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620","description":"Seen in \"Atomic macOS (AMOS) Stealer Activity\" (Palo Alto Unit 42). Context: fection persistent on the infected macOS host SHA-256 hash: 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620 File size: 438,576 bytes File location: /Users/[username]/L","pattern":"[file:hashes.'SHA-256' = '6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620']","pattern_type":"stix","valid_from":"2026-09-16T10:00:06.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--afb0b2dc-d0bf-4e74-919b-a4c7ba6f153e","created":"2026-09-16T10:00:06.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c","description":"Seen in \"Atomic macOS (AMOS) Stealer Activity\" (Palo Alto Unit 42). Context: a command run from the macOS Terminal window SHA-256 hash: 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c File size: 1,991 bytes File type: Zsh script text executabl","pattern":"[file:hashes.'SHA-256' = '71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c']","pattern_type":"stix","valid_from":"2026-09-16T10:00:06.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4b1e179-577f-40f1-a75e-300d0adfc5b6","created":"2026-09-16T10:00:06.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a","description":"Seen in \"Atomic macOS (AMOS) Stealer Activity\" (Palo Alto Unit 42). Context: cted from the initially downloaded Zsh script SHA-256 hash: 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a File size: 1,213 bytes File type: Zsh script text executabl","pattern":"[file:hashes.'SHA-256' = '7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a']","pattern_type":"stix","valid_from":"2026-09-16T10:00:06.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--862112b1-3a57-4521-a2bd-923fcd14c3cf","created":"2026-09-16T10:00:06.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9","description":"Seen in \"Atomic macOS (AMOS) Stealer Activity\" (Palo Alto Unit 42). Context: y long lines (323) Installer for AMOS stealer SHA-256 hash: a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9 File size: 330,768 bytes File location: /tmp/helper File ty","pattern":"[file:hashes.'SHA-256' = 'a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9']","pattern_type":"stix","valid_from":"2026-09-16T10:00:06.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--76441df8-80fb-458a-ba49-07be73388355","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8a","pattern":"[file:hashes.'SHA-256' = '106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a7f922f-bcf3-4245-b7e2-0230cba836f0","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 70e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127","pattern":"[file:hashes.'SHA-256' = '170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--deafdab7-7503-4b16-8731-ad273fe1cc22","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 81bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa4","pattern":"[file:hashes.'SHA-256' = '223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb6703b6-4298-4411-a15d-ddbeec8e8ed1","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 PowerShell extension-installer implementation Domain connec","pattern":"[file:hashes.'SHA-256' = '42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9581ca07-e0ad-448a-90b8-43771ba9de85","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c","pattern":"[file:hashes.'SHA-256' = '5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--33e87aa6-76b5-45ce-bfaf-262a928f3ffd","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 3811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2","pattern":"[file:hashes.'SHA-256' = 'ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7926235a-cfef-4544-aa21-1fc1263c59a0","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 89910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648b","pattern":"[file:hashes.'SHA-256' = 'c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f463c1e-4864-4308-bbbf-919879635a95","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc","pattern":"[file:hashes.'SHA-256' = 'cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6349bc34-80d7-42fc-9427-5dd76efb5bec","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: cb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975","pattern":"[file:hashes.'SHA-256' = '06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b8b5eb3-4e23-4069-8c10-253b8515c1f5","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: b7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c287","pattern":"[file:hashes.'SHA-256' = '131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4dd44d2-c8f9-4dbe-a2e6-04e6861804fb","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 3c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd","pattern":"[file:hashes.'SHA-256' = '18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d68a289a-493d-4c8f-b979-12fb2cc07144","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 9ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e8","pattern":"[file:hashes.'SHA-256' = '249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--26ecdb5c-fbde-4d27-8f91-60783ff314a7","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 2365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3","pattern":"[file:hashes.'SHA-256' = '279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cf90332-d75d-4f77-80ae-f4b5ecfdee21","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24 InstallFix MP3/HTA, InstallFix /cl and recovered InstallFix","pattern":"[file:hashes.'SHA-256' = '3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d68f827e-5b92-4d6a-b377-5b712bc8fe08","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 83129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92","pattern":"[file:hashes.'SHA-256' = '480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3aef2d98-3563-42a2-a120-33d491ce71bf","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: ake Ledger, Trezor and Exodus application artifacts SHA-256 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c89179","pattern":"[file:hashes.'SHA-256' = '5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d73a9ca-c0de-4358-bb57-665697456fd5","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739","pattern":"[file:hashes.'SHA-256' = '6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aad0f4d-310e-405d-bf34-351bb2f1e907","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 41ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494","pattern":"[file:hashes.'SHA-256' = '93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--76d1a9ad-8332-4070-865c-95a23ca5e943","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96 Houston, Pressureulcerlawyer, Lalandscapelighting, Aidevmas","pattern":"[file:hashes.'SHA-256' = '9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c5d9843-de02-422e-aec3-320849df8659","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5","pattern":"[file:hashes.'SHA-256' = 'a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b540a3ea-c0dd-498d-a4e9-0a82c3d66fd0","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0","pattern":"[file:hashes.'SHA-256' = 'd1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc5f65df-68e9-49fd-b4fb-76a019cd396a","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c","pattern":"[file:hashes.'SHA-256' = 'd4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9921ecbb-b80b-48d8-9e2a-d91595571d62","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c","pattern":"[file:hashes.'SHA-256' = 'd4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5e231c1-d40e-405b-b30a-9a932e346dfd","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e5","pattern":"[file:hashes.'SHA-256' = 'd95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--988a1b2c-8523-4216-8160-7c32a08b1c10","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c","pattern":"[file:hashes.'SHA-256' = 'e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad2ce58c-6a22-413c-bc1c-5cbee3507335","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: , InstallFix /cl and recovered InstallFix artifacts SHA-256 ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1a","pattern":"[file:hashes.'SHA-256' = 'ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--be910c8d-9240-4c93-81b3-77fa9c66380e","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 1301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb Fake Ledger, Trezor and Exodus application artifacts SHA-25","pattern":"[file:hashes.'SHA-256' = 'ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed0fe6e5-1cf4-460d-a9ee-86a327a058f4","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: ec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b","pattern":"[file:hashes.'SHA-256' = 'ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--47233083-1c52-441f-b5e2-5d243911e834","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: Selectors for getData() , balanceOf() and setData() SHA-256 eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf","pattern":"[file:hashes.'SHA-256' = 'eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--25361659-9061-4175-9fa0-2bf064af44db","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 63b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287","pattern":"[file:hashes.'SHA-256' = 'f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--179d4f7f-a7e5-4d86-a66f-f9eb0b53c73e","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: b41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f1","pattern":"[file:hashes.'SHA-256' = 'f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--47b1115d-2db7-4dd1-b2fb-e9822ab82d5d","created":"2026-09-14T13:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc","description":"Seen in \"Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users\" (Cyber Security News). Context: ple.com Twitch Enhanced Viewer Firefox Add-ons ID; SHA-256: 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc Note: IP addresses and domains are intentionally defanged (","pattern":"[file:hashes.'SHA-256' = '141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc']","pattern_type":"stix","valid_from":"2026-09-14T13:50:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/malicious-twitch-extension/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3ef571b-778a-466a-bd5b-38674cf74c2b","created":"2026-09-14T13:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8","description":"Seen in \"Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users\" (Cyber Security News). Context: ed Viewer | JeetBot Chrome Web Store extension ID; SHA-256: e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8 Firefox extension twitchenhancedviewer@example.com Twitch E","pattern":"[file:hashes.'SHA-256' = 'e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8']","pattern_type":"stix","valid_from":"2026-09-14T13:50:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/malicious-twitch-extension/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee4d4612-fda2-4270-ab28-d37648b06bff","created":"2026-09-14T13:01:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63","description":"Seen in \"One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users\" (Cyber Security News). Context: RAYRABBIT command-and-control domain using port 443 SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 Trojanized DLL loader, originally identified as 7zp.dll wit","pattern":"[file:hashes.'SHA-256' = '29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63']","pattern_type":"stix","valid_from":"2026-09-14T13:01:36.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/one-click-on-a-malicious-link/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b46a155-20b2-4f25-b9ec-4d84aa61b0cd","created":"2026-09-14T13:01:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e","description":"Seen in \"One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users\" (Cyber Security News). Context: ly identified as 7zp.dll with internal name boy.dll SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e Encrypted payload blob identified as p SHA-256 D7a3c7eb94ed","pattern":"[file:hashes.'SHA-256' = '749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e']","pattern_type":"stix","valid_from":"2026-09-14T13:01:36.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/one-click-on-a-malicious-link/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4105d3d5-6584-4941-9ef7-470cddcfedaf","created":"2026-09-14T13:01:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a","description":"Seen in \"One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users\" (Cyber Security News). Context: 98662e02422e Encrypted payload blob identified as p SHA-256 D7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor with internal name core.dll File name 7","pattern":"[file:hashes.'SHA-256' = 'd7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a']","pattern_type":"stix","valid_from":"2026-09-14T13:01:36.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/one-click-on-a-malicious-link/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e75e703-3667-48b6-9c4f-cd1c6e7e8de9","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 1b17917e2e183a4bd9cbcb2ed77e Malicious PDF lure PDF SHA-256 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a Malicious PDF lure Email SHA-256 debe871710268e7bb770b72c67","pattern":"[file:hashes.'SHA-256' = '0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--77d2f821-8870-40d5-ad69-8e73058c7106","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 659880e1a8a7b0a2dd851dc5e7a3 Malicious PDF lure PDF SHA-256 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5 Malicious PDF lure PDF SHA-256 c521b3a189b0089a2558aa4e42bd","pattern":"[file:hashes.'SHA-256' = '0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--755fb23c-e0a7-45ac-acf9-5413d850119b","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 4a2145348b953b1d06e2eaf0bf2c Malicious PDF lure PDF SHA-256 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed Malicious PDF lure PDF SHA-256 62ef39ec29966d71c8254f68bd5e","pattern":"[file:hashes.'SHA-256' = '1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--48af80c3-3f75-4815-97c7-e05f5d17f1d4","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 042d76c12dbafdcc0766861827c5 Malicious PDF lure PDF SHA-256 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491 Malicious PDF lure PDF SHA-256 ea8af591fe2d605c82bb7831d2eb","pattern":"[file:hashes.'SHA-256' = '1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--edcfa42d-ad8a-435f-80fc-e36e4668c1f6","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 64f8db457bafafb97a011da59e73 Malicious PDF lure PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd Malicious PDF lure PDF SHA-256 bf92a287a3d79afb73a3f2d38877","pattern":"[file:hashes.'SHA-256' = '40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdf250c8-f690-442d-9a62-9351f894846e","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 89eb6b87bb0 2f0bd59d565 Phishing email artifact HTA SHA-256 4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044 HTA downloader HTA SHA-256 85767416f8d1e73833ccaa193263d119","pattern":"[file:hashes.'SHA-256' = '4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--617d380e-1899-4b27-aaf4-d943e1922efe","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 246d3d50110c6b0c248919ad796c6fd4 HTA downloader HTA SHA-256 4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697 HTA downloader HTA SHA-256 92a1428e125f33de012c7f52fb0827be","pattern":"[file:hashes.'SHA-256' = '4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf4b46f0-2a88-4f01-b26c-e34e404de387","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: ca6e1b70fe30ba3752b881574365 Malicious PDF lure PDF SHA-256 47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95 Malicious PDF lure PDF SHA-256 d13ad6fc5fda54e65f1214e554a5","pattern":"[file:hashes.'SHA-256' = '47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fd3a7c7-1e40-4bf6-b4c8-0c4f14c40d77","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 3b5c42dd2a33b5a6520159b41c43b093 HTA downloader HTA SHA-256 51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c HTA downloader HTA SHA-256 5b3c2442831d4844ea6b86942f1a0ba2","pattern":"[file:hashes.'SHA-256' = '51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--56000b55-5cd9-4a4c-b3ca-22c44354e0cd","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: f537a02949315eb768c88906b0c65add HTA downloader HTA SHA-256 5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e HTA downloader HTA SHA-256 8092b9de455463296898fcaf8c9955d1","pattern":"[file:hashes.'SHA-256' = '5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--14a285c5-a476-4d49-b65f-9ce35698c817","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: c8224686669ba4b64196591414fdc64c HTA downloader HTA SHA-256 5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02 HTA downloader HTA SHA-256 71dea06c2271a46fc2fd6092e2ba0c2f","pattern":"[file:hashes.'SHA-256' = '5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f43b1942-29e0-4876-852a-e7709b001065","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: badab12bcdcb47f3dad8bc6fa8ed Malicious PDF lure PDF SHA-256 62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5 Malicious PDF lure PDF SHA-256 1f1a89bef73e4866a198a08e750f","pattern":"[file:hashes.'SHA-256' = '62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c29c692-fceb-4a20-9d82-1c8bcc9af187","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 02b1b25b78e5f3707e81bad5054cf4e8 HTA downloader HTA SHA-256 6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093 HTA downloader HTA SHA-256 51503ce1373c7fa72a1da5c5c4b30f88","pattern":"[file:hashes.'SHA-256' = '6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eff0dd5c-1038-4a65-a248-d03112b0700c","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: compromise (IoCs):- Type Indicator Description PDF SHA-256 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 Malicious PDF lure PDF SHA-256 40d253480f752805e58c21266e40","pattern":"[file:hashes.'SHA-256' = '6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7bb7c78-cea6-4b91-915c-69d891104cef","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: aff294f5250c2eed406765032cb68756 HTA downloader HTA SHA-256 6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4 HTA downloader HTA SHA-256 4540c3af3b1d8c52256f4580dd4d002f","pattern":"[file:hashes.'SHA-256' = '6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbb22404-e8d8-4c06-9339-7cff35926f85","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: ff91c829d87f566bee453d715280 Malicious PDF lure PDF SHA-256 711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859 Malicious PDF lure PDF SHA-256 d910e08a11a4f6f764e7495f4602","pattern":"[file:hashes.'SHA-256' = '711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--155bbf7c-085b-491b-bf66-0f08065d9021","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 7170018382cbc362343db63717d0ff02 HTA downloader HTA SHA-256 71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b HTA downloader Domain 128[.]200[.]178[.]68[.]host[.]secures","pattern":"[file:hashes.'SHA-256' = '71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a523789a-730f-4ffc-88f9-3291deb614f4","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 5d7407ba AutoIt loader component Casbaneiro payload SHA-256 7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8 Casbaneiro payload Cryptocurrency address 0xb4c12078448fdef","pattern":"[file:hashes.'SHA-256' = '7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a76fbca-8108-4fc0-b246-db0db56b513d","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 2abf7f72ef093292c86c1e9e7c2be456 HTA downloader HTA SHA-256 7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8 HTA downloader HTA SHA-256 6547736c31dabb5bef2a290b32a72bf6","pattern":"[file:hashes.'SHA-256' = '7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a6d955b-7b69-4fcf-97c4-17f33971f60b","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 976b299ee27c5fc3d42f2673170ab95e HTA downloader HTA SHA-256 8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33 HTA downloader HTA SHA-256 99fcabf7c996d6ec077ccd745a158a3a","pattern":"[file:hashes.'SHA-256' = '8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--659c7eb5-83b7-4279-8756-951470de5a43","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 50c8155ed113f3f62337d756e6915044 HTA downloader HTA SHA-256 85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f HTA downloader HTA SHA-256 f1aa14ebfd2da477edba94b34f09f775","pattern":"[file:hashes.'SHA-256' = '85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0976e43a-4c0f-4090-b95d-f33f6b80735b","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 395403d6a3df9d8da179f3cd5faf81b1 HTA downloader HTA SHA-256 875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b HTA downloader HTA SHA-256 bd724bbb27f9a71fd44f1c334b003541","pattern":"[file:hashes.'SHA-256' = '875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff48a211-b449-4cdd-a2f0-e43086d759f4","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: adb8c5ff4e32e6a41fdf508455c5b697 HTA downloader HTA SHA-256 92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c HTA downloader HTA SHA-256 e57409c5e1f8287900c1c3b3e8c099ce","pattern":"[file:hashes.'SHA-256' = '92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2110b82-bba3-44d2-934a-9b469669162a","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 9f4a7d6ac2e0385472298f384fc8 Malicious PDF lure PDF SHA-256 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 Malicious PDF lure PDF SHA-256 711c0aa8cde078aa349fb329e3e4","pattern":"[file:hashes.'SHA-256' = '943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4e1fb08-88eb-46ea-af97-dd4bc47722f0","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: c00dae6812c03bba019edf9c059ece33 HTA downloader HTA SHA-256 99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1 HTA downloader HTA SHA-256 875e8d4137e1016b4be869e36e00a941","pattern":"[file:hashes.'SHA-256' = '99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b718f4e-7e0f-4ddb-bb83-3f8622256cee","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 761071655fa585b64eed3bd78fc28e01 HTA downloader HTA SHA-256 a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456 HTA downloader HTA SHA-256 7e04e86c07213fed7bebccd9953818b1","pattern":"[file:hashes.'SHA-256' = 'a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ae30fc-b7c9-4e23-8580-3e5619810c97","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 4e89902fd5592a2fb881ebb0e4bd2f8b HTA downloader HTA SHA-256 bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01 HTA downloader HTA SHA-256 a42daeca71a6bdc79fd66b8b6ee41356","pattern":"[file:hashes.'SHA-256' = 'bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--28a83430-9b43-4496-bd78-02e3f489911f","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 96feea0d355732af5bea459db1dd Malicious PDF lure PDF SHA-256 bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 Malicious PDF lure PDF SHA-256 943d63ace373ee50d074daf84d35","pattern":"[file:hashes.'SHA-256' = 'bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c497ed0c-307d-445c-96dd-ac7f536bf1e9","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 485688b5958d82fcb072a837e27e246b HTA downloader HTA SHA-256 c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756 HTA downloader HTA SHA-256 6e6bd2f7566ffa52d52fa9d5f048bbb9","pattern":"[file:hashes.'SHA-256' = 'c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c527ccf7-2580-4952-a041-aa7fd12401de","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: fae0b57d708aebd77d99667616d5 Malicious PDF lure PDF SHA-256 c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e Malicious PDF lure PDF SHA-256 0849a6b87fbef25089ad0be746f8","pattern":"[file:hashes.'SHA-256' = 'c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3eac7e8f-5f44-41b3-b7fa-4f416ed49379","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 7b3ce6db57566ed7bd0e92d03d85 Malicious PDF lure PDF SHA-256 d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c Malicious PDF lure PDF SHA-256 1b4d5c95f4fc037ca3c359cea5ca","pattern":"[file:hashes.'SHA-256' = 'd04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb088dc0-d7a3-48af-b700-d154d37733d0","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 1a2f0f8eac289e6b653a5d126f95 Malicious PDF lure PDF SHA-256 d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85 Malicious PDF lure PDF SHA-256 d04f68079ca90c65223a907f23fa","pattern":"[file:hashes.'SHA-256' = 'd13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--000b196a-3bdf-470b-9ecd-d78bf6d8df47","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 66a5e651ad8a64893c76a725c859 Malicious PDF lure PDF SHA-256 d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365 Malicious PDF lure PDF SHA-256 47d321c1a232e5cdd1e39a06dadb","pattern":"[file:hashes.'SHA-256' = 'd910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8839237-3f2a-4662-9c68-0223f04fae22","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 3d7e90e38a0e38083181f8c3312adc9c HTA downloader HTA SHA-256 e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add HTA downloader HTA SHA-256 5a76669ec410d0b3e21112a4a6fd3207","pattern":"[file:hashes.'SHA-256' = 'e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2d39f25-28ba-436f-88db-eb3831a82739","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: b82816a8353e9a8a574bfde5f491 Malicious PDF lure PDF SHA-256 ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3 Malicious PDF lure PDF SHA-256 0b4d962eef2d06abfe08a8cd0b15","pattern":"[file:hashes.'SHA-256' = 'ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f6b2a55-ed12-477f-8f52-95efaa3877f4","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 8857308b3a1185e6f4ebc4164db8584f HTA downloader HTA SHA-256 f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b HTA downloader HTA SHA-256 c477bdfae91e3df9be29e9eeba785467","pattern":"[file:hashes.'SHA-256' = 'f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f9be4a2-7c93-4846-bce0-baf777c57c20","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: b07b25cc7d910 AutoIt loader component AutoIt script SHA-256 f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba AutoIt loader component Casbaneiro payload SHA-256 7de63753","pattern":"[file:hashes.'SHA-256' = 'f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2712384-e6d8-4832-aaab-efb2cc5c49f6","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 99[.]188[.]28 Campaign infrastructure AutoIt script SHA-256 fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910 AutoIt loader component AutoIt script SHA-256 f76d09cbd455c","pattern":"[file:hashes.'SHA-256' = 'fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ebb069c-0eb6-4896-94ac-0cc389a3c588","created":"2026-09-14T08:09:26.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63","description":"Seen in \"China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor\" (GBHackers). Context: involving 7-Zip binaries. IOCs Indicator Value SHA-256 hash 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 Associated file 7zp.dll File description Trojanized DLL loa","pattern":"[file:hashes.'SHA-256' = '29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63']","pattern_type":"stix","valid_from":"2026-09-14T08:09:26.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/grayrabbit-backdoor/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba8a7452-067f-4821-865e-69c95923389e","created":"2026-09-14T08:09:26.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e","description":"Seen in \"China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor\" (GBHackers). Context: on Trojanized DLL loader Internal name boy.dll SHA-256 hash 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e Associated file p File description Encrypted PE loader shel","pattern":"[file:hashes.'SHA-256' = '749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e']","pattern_type":"stix","valid_from":"2026-09-14T08:09:26.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/grayrabbit-backdoor/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb95d2a5-a331-4e43-a036-06c03099766c","created":"2026-09-14T08:09:26.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a","description":"Seen in \"China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor\" (GBHackers). Context: File description Encrypted PE loader shellcode SHA-256 hash d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a Associated malware GRAYRABBIT backdoor Internal name core.d","pattern":"[file:hashes.'SHA-256' = 'd7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a']","pattern_type":"stix","valid_from":"2026-09-14T08:09:26.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/grayrabbit-backdoor/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--52bcde6e-0f84-487a-b823-4d7b250a4586","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: de3cdf Resource icon shared across ARKTunnel samples SHA256 06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5 Resource icon shared across ARKTunnel samples SHA256 2c6e11","pattern":"[file:hashes.'SHA-256' = '06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7045149-1a30-4bdd-b617-bfed24b74aa0","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 9ed15ce1a6961 eld0.exe , Insomnia RAT initial loader SHA256 25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5 eld0.tmp unpacked loader stage SHA256 9b0d9cbc0fd4a7bae8b78","pattern":"[file:hashes.'SHA-256' = '25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--825d9184-8296-4e20-92a8-007a1ce066ee","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 6cdac5 Resource icon shared across ARKTunnel samples SHA256 2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354 eld2.exe , Docro Hijacker branch installer SHA256 553ce594c","pattern":"[file:hashes.'SHA-256' = '2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5e7a0cb-9178-4122-ba90-476f8c865923","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: efff1f2d73 windirstat.tmp unpacked OfferLoader stage SHA256 3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961 eld0.exe , Insomnia RAT initial loader SHA256 25558ea78c4aa","pattern":"[file:hashes.'SHA-256' = '3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--577198a6-241d-4e00-bea0-b22260a60337","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 2c297d354 eld2.exe , Docro Hijacker branch installer SHA256 553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104 eld2.tmp , unpacked Docro Hijacker stage SHA256 fdcc95b7791","pattern":"[file:hashes.'SHA-256' = '553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--37589973-51c1-458c-8a2f-39cd12627b0a","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: de Python component of the Insomnia RAT dual payload SHA256 62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e aa.js , Node.js component of the Insomnia RAT dual payload","pattern":"[file:hashes.'SHA-256' = '62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--740e8ffa-5142-4758-84f2-2349ee136524","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: rs of Compromise (IoCs):- Type Indicator Description SHA256 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c Trojanized windirstat.exe OfferLoader installer delivered t","pattern":"[file:hashes.'SHA-256' = '7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3460c95-1c33-4821-a51a-d1478af7bb59","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 9d144a5801a40e48fd4c5 eld0.tmp unpacked loader stage SHA256 9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69 a.dll , PowerShell downloader for Insomnia RAT stages SHA25","pattern":"[file:hashes.'SHA-256' = '9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f1dba00-eedf-4831-b004-c3ad708408ab","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: , Node.js component of the Insomnia RAT dual payload SHA256 aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1 eld1.exe , ARKTunnel steganography dropper SHA256 e05bc22af","pattern":"[file:hashes.'SHA-256' = 'aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0089b312-96a1-413c-83c9-8155fd81499e","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: Trex.zip , archive extracted from the bitmap payload SHA256 b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c wscl.exe , ARKTunnel WebSocket tunneling RAT SHA256 d8d783f","pattern":"[file:hashes.'SHA-256' = 'b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6a5b2a2-3e95-42ef-b0cb-d06f17e576bc","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: .dll , PowerShell downloader for Insomnia RAT stages SHA256 ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e t.ps1 , Insomnia RAT PowerShell loader SHA256 cf184d04ca31f","pattern":"[file:hashes.'SHA-256' = 'ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd6aff3a-2932-4a4f-a553-d796cccd51e3","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 0b4d636eb576e t.ps1 , Insomnia RAT PowerShell loader SHA256 cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de Python component of the Insomnia RAT dual payload SHA256 62","pattern":"[file:hashes.'SHA-256' = 'cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--122c999c-fa49-4e34-8e7c-b472cb293c72","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: c87989c wscl.exe , ARKTunnel WebSocket tunneling RAT SHA256 d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf Resource icon shared across ARKTunnel samples SHA256 06e0af","pattern":"[file:hashes.'SHA-256' = 'd8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eb636dc-f0bc-404f-83d9-f2ed8d8091d3","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 90b4560f1 eld1.exe , ARKTunnel steganography dropper SHA256 e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d procorTrex.zip , archive extracted from the bitmap payload","pattern":"[file:hashes.'SHA-256' = 'e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--74c01347-c7d3-414d-ba6f-74b4ef5196e5","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: fferLoader installer delivered through SEO poisoning SHA256 fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 windirstat.tmp unpacked OfferLoader stage SHA256 3052bd320a","pattern":"[file:hashes.'SHA-256' = 'fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0ea1999-9fff-4a0b-b350-0a5a49a907e5","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: c15bab72104 eld2.tmp , unpacked Docro Hijacker stage SHA256 fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007 Adblock.dll , Chrome Secure Preferences bypass DLL File nam","pattern":"[file:hashes.'SHA-256' = 'fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--99d8070f-72bf-414c-9e75-f7001a00af2a","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: 76409f69d445a93910964f8db457bafafb97a011da59e73 PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd Email SHA-256 debe871710268e7bb770b72c6772f2e0b8bd40a22b2ea","pattern":"[file:hashes.'SHA-256' = '40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6753ad49-bc81-4d21-87da-45f1efc9b6eb","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: o financial websites. IOCs Indicator type Value PDF SHA-256 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355","pattern":"[file:hashes.'SHA-256' = '6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--28dd90c5-ce0d-458a-9ed7-0c8705fcc550","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: c21266e40afe99afc96feea0d355732af5bea459db1dd Email SHA-256 debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email SHA-256 eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc6","pattern":"[file:hashes.'SHA-256' = 'debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--356d2781-2a4e-4d46-b64f-70c43c381b41","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: 0b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email SHA-256 eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 Domain 128[.]200[.]178[.]68[.]host[.]secureserver[.]net Dom","pattern":"[file:hashes.'SHA-256' = 'eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f873f9a2-3f1e-4deb-9bb7-76f744274b32","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: 122ea3cbcb99c8a525b0b30ab985bc8e375c7a 3200000_02C37000.exe 15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda Note: IP addresses and domains are intentionally defanged (","pattern":"[file:hashes.'SHA-256' = '15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--df0f27d6-6dd3-4946-a87e-90d7663246e7","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: d5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c 3200000.exe 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a 3200000_02C37000.exe 15700817e517fefcabc0291e350daf3e10d52f","pattern":"[file:hashes.'SHA-256' = '22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--676da83b-b529-4aa8-9801-a030a4351c5d","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: 1fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6 kojuyn.ini 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c 3200000.exe 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b","pattern":"[file:hashes.'SHA-256' = '4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a4fc219-2104-475b-97b3-01350f241920","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: Cs Filename SHA-256 Right-click to open Invoice Details.bat ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6 kojuyn.ini 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c74","pattern":"[file:hashes.'SHA-256' = 'ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--68fc9f74-c37d-4d3c-989a-1f43a495cd7f","created":"2026-09-14T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42","description":"Seen in \"The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions\" (Elastic Security Labs). Context: tection For this analysis, we examine the following script: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 . The obfuscation is fairly basic: function names are repla","pattern":"[file:hashes.'SHA-256' = '106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42']","pattern_type":"stix","valid_from":"2026-09-14T00:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Elastic Security Labs","url":"https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e4c3e35-8c7f-420f-a7e5-b105b81c17d8","created":"2026-09-14T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552","description":"Seen in \"The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions\" (Elastic Security Labs). Context: ful pivot for finding additional first-stage samples (e.g., 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 ). The sandbox-detection heuristic consists of two checks.","pattern":"[file:hashes.'SHA-256' = '5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552']","pattern_type":"stix","valid_from":"2026-09-14T00:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Elastic Security Labs","url":"https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3e49585-a362-4de4-b174-51816e9f0cce","created":"2026-09-14T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268","description":"Seen in \"The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions\" (Elastic Security Labs). Context: ugging. For this analysis, we examine the following binary: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 . KREMLIN string decryption algorithm As noted at the begin","pattern":"[file:hashes.'SHA-256' = 'c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268']","pattern_type":"stix","valid_from":"2026-09-14T00:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Elastic Security Labs","url":"https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f31ac16-6ec2-425a-a8cd-6ccef1d711ff","created":"2026-09-12T08:04:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3","description":"Seen in \"China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks\" (GBHackers). Context: 256 UTA0560 msgbox.exe GRIMWEDGE loader, a Win32 executable 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 SHA-256 JungleBamboo a001 LONGTALE malicious Chrome extensi","pattern":"[file:hashes.'SHA-256' = '5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3']","pattern_type":"stix","valid_from":"2026-09-12T08:04:47.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--13aeb5e1-43e6-4951-92a8-de3cace21edb","created":"2026-09-12T08:04:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc","description":"Seen in \"China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks\" (GBHackers). Context: mber 2 phishing URL serving the shared Chrome exploit chain 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc SHA-256 UTA0560 msgbox.exe GRIMWEDGE loader, a Win32 execut","pattern":"[file:hashes.'SHA-256' = '69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc']","pattern_type":"stix","valid_from":"2026-09-12T08:04:47.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--790db1cf-57e8-44a7-b500-31c28f81fc65","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: 056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d54","pattern":"[file:hashes.'SHA-256' = '13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b34f8ac-5abf-4246-82ce-4d0ce6fb3b10","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b3","pattern":"[file:hashes.'SHA-256' = '6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--57432364-7abf-4876-8d7c-43b5a2fb3fb8","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: 99c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 sample IP address 160[.]191.242.92 Observed Te","pattern":"[file:hashes.'SHA-256' = '9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa71778d-e88d-4ec4-ae09-180c34240e43","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: 92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a9","pattern":"[file:hashes.'SHA-256' = '9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f89c6b5a-bd80-4d2d-a4b3-9740eb7f5e66","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: and executed after Telnet credential brute forcing SHA-256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2","pattern":"[file:hashes.'SHA-256' = 'cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--793fe989-8a91-4837-8cb3-69ee6ad5e038","created":"2026-09-11T12:24:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c","description":"Seen in \"Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign\" (GBHackers). Context: look ordinary. IOCs SHA-256 File Name File Type Description 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c windirstat.exe PE32 executable; Inno Setup 6.7.1 installer","pattern":"[file:hashes.'SHA-256' = '7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c']","pattern_type":"stix","valid_from":"2026-09-11T12:24:51.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/10000-malware-loaders/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee5b06f4-2bcb-4f78-ad7f-eca105931d49","created":"2026-09-11T12:24:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73","description":"Seen in \"Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign\" (GBHackers). Context: at installer distributed through an SEO-poisoning campaign. fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 windirstat.tmp PE32 executable; unpacked Inno Setup stage U","pattern":"[file:hashes.'SHA-256' = 'fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73']","pattern_type":"stix","valid_from":"2026-09-11T12:24:51.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/10000-malware-loaders/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae2f1e11-094c-474b-8f44-7dad56813716","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 382be8e1ddbebf3cdf4733cf989ba291f9013 SloppyRAT DLL SHA-256 00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec SloppyRAT DLL SHA-256 93273ea09bd9df881a594db8cfe1b1bbc54f4","pattern":"[file:hashes.'SHA-256' = '00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaef5b87-d880-43b2-bd92-2cb60b1063d2","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: ebdbecb3322453bdc41b2113427f9f92d32d2 SloppyRAT DLL SHA-256 1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd SloppyRAT DLL SHA-256 eaa52d2d6d4daf29157e8e813247fb2e92797","pattern":"[file:hashes.'SHA-256' = '1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdf2f563-510f-4d9c-b674-2a4279656dd1","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 5e0ee093541d99a9dba5f69a264f7f3054b19 SloppyRAT DLL SHA-256 2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2 SloppyRAT DLL SHA-256 1439990ff65364a0f608a322aa3a493bc1683","pattern":"[file:hashes.'SHA-256' = '2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b97219ee-ca8f-4c73-88ed-92a18f25329b","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: a5bcbf9a287d4653de7b76051bde73a94d064 SloppyRAT DLL SHA-256 3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19 SloppyRAT DLL SHA-256 2f3d95de716f330fad2330d8787ebdbecb332","pattern":"[file:hashes.'SHA-256' = '3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b4f7f9a-a56f-4621-8e21-468164ea781a","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 60f6d09ddb5be36cc1766a41d77c5b89d3a56 SloppyRAT DLL SHA-256 466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8 SloppyRAT DLL SHA-256 f534a957edec74d69081665309311b791b6d1","pattern":"[file:hashes.'SHA-256' = '466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3478b23a-c7e7-4d52-b861-485ba534a789","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: d1d8b6e9847aa6b8613493e5bc233ece3d189 SloppyRAT DLL SHA-256 4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56 SloppyRAT DLL SHA-256 466f9b8dce77b3a026fe4f833aa4949784fb8","pattern":"[file:hashes.'SHA-256' = '4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbc229cd-79e1-42aa-88f5-198d61233a65","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: e3b763bd4a4b0cdf59eeff981d8e307fcf316 SloppyRAT DLL SHA-256 518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064 SloppyRAT DLL SHA-256 3a8994928f512fffcb32e117ac45e0ee09354","pattern":"[file:hashes.'SHA-256' = '518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a48b6d4-bf18-4ae1-966d-684988d4803b","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 7374e2234f2a497b19d26637018a1839e6dfd SloppyRAT DLL SHA-256 607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9 SloppyRAT DLL SHA-256 7bb025b426ae6ccbc170fbca58634b8dd77a6","pattern":"[file:hashes.'SHA-256' = '607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--161cec36-2502-4cab-87f2-47fe3067df91","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: ebbe05561f3a19c7fc2d08e38c97e1986bbc5 SloppyRAT DLL SHA-256 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SloppyRAT DLL SHA-256 bdcf8fe230e23692b658b62b6547374e2234f","pattern":"[file:hashes.'SHA-256' = '680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--904b870a-b758-4d98-9bb5-59893a3547ca","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 34b8dd77a61447e48dabe9c2e2fb0d339d8b7 SloppyRAT DLL SHA-256 6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013 SloppyRAT DLL SHA-256 00c116e498799dc831c8aeb602349296c4b93","pattern":"[file:hashes.'SHA-256' = '6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--265e224d-40d2-44f5-888e-dd2c4a0f5537","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: f37a47f4c8aad08e6d5cbb7c19a62c6b765f9 SloppyRAT DLL SHA-256 7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7 SloppyRAT DLL SHA-256 6d50bb50d4e7d6ac36ca6d2761f382be8e1dd","pattern":"[file:hashes.'SHA-256' = '7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--568ec4ce-a6bd-4ee6-864f-b8ffa33b65eb","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 0a091743cf567396201eff7731f5475768f9a SloppyRAT DLL SHA-256 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990 SloppyRAT DLL SHA-256 ff142fc192daa2a83bc565e5b38ebbe05561f","pattern":"[file:hashes.'SHA-256' = '8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--990ad9a6-3b3c-4302-ae63-8a8a4e8b8a6c","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 49296c4b9325535d674fe2b6e2e091878dcec SloppyRAT DLL SHA-256 93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490 SloppyRAT DLL SHA-256 971f25f84be88c4fd304d555b5e3da12f6b36","pattern":"[file:hashes.'SHA-256' = '93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3acecbd-bc89-42a0-bbbc-5a922cb56b1c","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 1b1bbc54f40f623f44427278ae96fb9b46490 SloppyRAT DLL SHA-256 971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d SloppyRAT DLL SHA-256 a13fcbb0870f2fabb7e0a8c757ee3b763bd4a","pattern":"[file:hashes.'SHA-256' = '971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f86c3f9-7b7b-4b77-b4c1-deb638991828","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a SloppyRAT DLL SHA-256 8774533134d9d1514106c4090a0c5bccab455","pattern":"[file:hashes.'SHA-256' = '9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--722f2e8b-52bf-4181-891e-c96d1580cdbc","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 3da12f6b368e4b9ba0943961ff21ba6fa4d4d SloppyRAT DLL SHA-256 a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316 SloppyRAT DLL SHA-256 518cd57a303ff7ac2b5c4c8439aa5bcbf9a28","pattern":"[file:hashes.'SHA-256' = 'a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c97860a-68d2-49e4-8709-5d9b9ae5241b","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SloppyRAT DLL SHA-256 bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd SloppyRAT DLL SHA-256 607212cfe73c5c84b2dd95b2c0ff37a47f4c8","pattern":"[file:hashes.'SHA-256' = 'bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9f41030-8777-4a03-8e4e-91173f1688ea","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 60b937c7beaf9ab51b03191dfcaba40b7b189 SloppyRAT DLL SHA-256 c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189 SloppyRAT DLL SHA-256 4ecb2d06510dfee1b67f5d9a68c60f6d09ddb","pattern":"[file:hashes.'SHA-256' = 'c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e736752-5dcf-4870-a675-bce4bad842c4","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 7fb2e92797324230ee42c79f7861b2f5c341d SloppyRAT DLL SHA-256 cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189 SloppyRAT DLL SHA-256 c0ef62a2d5ca11c2eedad3561d5d1d8b6e984","pattern":"[file:hashes.'SHA-256' = 'cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1743df68-bdc9-45ab-9548-dbaf5050598f","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: a493bc1683cb5fc30cffc44948da29623fffd SloppyRAT DLL SHA-256 eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d SloppyRAT DLL SHA-256 cb9930d0cde5bf8e8a7ad08fe2c60b937c7be","pattern":"[file:hashes.'SHA-256' = 'eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--946a6222-97d2-4d2b-8fc2-a9b072b54dbe","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 4949784fb854bea4137e52609e857d439dec8 SloppyRAT DLL SHA-256 f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb config.py Python script Domain finger.linked4x[.]com ClickF","pattern":"[file:hashes.'SHA-256' = 'f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd61a8cc-011d-49c1-957b-c85eb429e10b","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: c5bccab4550facdcfe03f4e02b9764343a990 SloppyRAT DLL SHA-256 ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5 SloppyRAT DLL SHA-256 680c3a9f5fdddfcc34856c7a67d21bbdd2b47","pattern":"[file:hashes.'SHA-256' = 'ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc9518cc-9a04-40e7-84d9-da8d3820e2be","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: nd execute an ARM payload named vlxx.arm, with SHA-256 hash 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4. Staging markers including condi72 and condixx link the del","pattern":"[file:hashes.'SHA-256' = '13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--08d7ae35-734d-4b59-8f7a-70a7e1fb06cd","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: 634b8031ec254d98b876e59692b5fa22abc1d4 SHA-256 Hash (ARM32) 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f SHA-256 Hash (ARM32) 9d87e6615c810907443ebd5e915f3b35099c3b","pattern":"[file:hashes.'SHA-256' = '6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e05536-277c-4397-94f0-05e2eeb93984","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: 5f3b35099c3b5c6b6c684637138a7f8ec9cebc SHA-256 Hash (AMD64) 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 IPv4 Address 160[.]191.242.92 Telnet credential brute-force","pattern":"[file:hashes.'SHA-256' = '9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a574631-4afe-4207-8690-1a7cd4eb90a4","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: 2d548ce92dda71e82dc47e8efe13f30617f35f SHA-256 Hash (ARM32) 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc SHA-256 Hash (AMD64) 9d7cd4948a1fcbaeadc425752fce9a933bd6fc","pattern":"[file:hashes.'SHA-256' = '9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad376de4-9b14-4af3-b9e7-d6e2dc4fc4d5","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: imperfect. IOCs Indicator Type Value SHA-256 Hash (Loader) cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 SHA-256 Hash (ARM32) 13382c16e2401b07451577b46e634b8031ec25","pattern":"[file:hashes.'SHA-256' = 'cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7a70e9f-b412-4d03-9c40-0e0a5010a3aa","created":"2026-09-11T07:14:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63","description":"Seen in \"China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor\" (The Hacker News). Context: dy running. Gen published the following indicators. SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 malicious DLL loader, written to disk as 7z.dll SHA-256 749","pattern":"[file:hashes.'SHA-256' = '29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63']","pattern_type":"stix","valid_from":"2026-09-11T07:14:09.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7416417-3d23-4b62-90ea-fd7fcebd7262","created":"2026-09-11T07:14:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e","description":"Seen in \"China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor\" (The Hacker News). Context: a63 malicious DLL loader, written to disk as 7z.dll SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e encrypted payload file, named p SHA-256 d7a3c7eb94edc0e020f","pattern":"[file:hashes.'SHA-256' = '749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e']","pattern_type":"stix","valid_from":"2026-09-11T07:14:09.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--acf92fee-9b9a-4b83-b040-e2a33c17c048","created":"2026-09-11T07:14:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a","description":"Seen in \"China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor\" (The Hacker News). Context: 74d675a98662e02422e encrypted payload file, named p SHA-256 d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor, internal name core.dll Domain mail.uai","pattern":"[file:hashes.'SHA-256' = 'd7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a']","pattern_type":"stix","valid_from":"2026-09-11T07:14:09.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5882f9d3-53a9-4abc-abed-4c09646f1ec7","created":"2026-09-11T07:11:14.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b","description":"Seen in \"UK Council Attack Linked to Mass Exploitation of SonicWall Flaw\" (Security Affairs). Context: ts. The SHA-256 of the Impacket binary the operator used is 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b , and the delivery IP was 95.181.173[.]36. The operator ran","pattern":"[file:hashes.'SHA-256' = '690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b']","pattern_type":"stix","valid_from":"2026-09-11T07:11:14.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Security Affairs","url":"https://securityaffairs.com/198864/hacking/uk-council-attack-linked-to-mass-exploitation-of-sonicwall-flaw.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a886551-e98b-4015-8869-0dae67ecc1ba","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: be05561f3a19c7fc2d08e38c97e1986bbc5 SHA256 of SloppyRAT DLL 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SHA256 of SloppyRAT DLL bdcf8fe230e23692b658b62b6547374e223","pattern":"[file:hashes.'SHA-256' = '680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3962eadb-e66d-4996-8764-927be639d245","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: 091743cf567396201eff7731f5475768f9a SHA256 of SloppyRAT DLL 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990 SHA256 of SloppyRAT DLL ff142fc192daa2a83bc565e5b38ebbe0556","pattern":"[file:hashes.'SHA-256' = '8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbe0838d-7f7a-4bb2-8568-1219b135d7b5","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: vent. Indicators Of Compromise (IOCs) Indicator Description 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a SHA256 of SloppyRAT DLL 8774533134d9d1514106c4090a0c5bccab4","pattern":"[file:hashes.'SHA-256' = '9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff614744-ac44-49a5-aeb0-914d3a96c6fc","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SHA256 of SloppyRAT DLL bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd SHA256 of SloppyRAT DLL Note: IP addresses and domains are","pattern":"[file:hashes.'SHA-256' = 'bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--57366ac9-e250-43a2-88b6-9ee4a5388277","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: bccab4550facdcfe03f4e02b9764343a990 SHA256 of SloppyRAT DLL ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5 SHA256 of SloppyRAT DLL 680c3a9f5fdddfcc34856c7a67d21bbdd2b","pattern":"[file:hashes.'SHA-256' = 'ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cce4db78-3a09-4563-8a3a-3e1f995253b7","created":"2026-09-11T05:30:08.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461","description":"Seen in \"Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware\" (GBHackers). Context: 026-20079 91.214.78[.]118 UAT-11823 Netcat reverse-shell C2 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink ELF malware 43.204.2[.]142 UAT-1198","pattern":"[file:hashes.'SHA-256' = '6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461']","pattern_type":"stix","valid_from":"2026-09-11T05:30:08.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/critical-cisco-fmc-flaws-actively-exploited/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f65f671-668d-4e34-83b8-2c4b036ec998","created":"2026-09-11T05:30:08.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d","description":"Seen in \"Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware\" (GBHackers). Context: as MISP, VirusTotal, or your SIEM. IOC Cluster Description b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp JSP web shell db491181ece3f319de6567ab6f","pattern":"[file:hashes.'SHA-256' = 'b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d']","pattern_type":"stix","valid_from":"2026-09-11T05:30:08.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/critical-cisco-fmc-flaws-actively-exploited/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcd77ee7-0a76-4737-ac5f-0a8909744c02","created":"2026-09-11T05:30:08.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e","description":"Seen in \"Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware\" (GBHackers). Context: fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp JSP web shell db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd.jar JAR-based command executor 89.34.96[.]56","pattern":"[file:hashes.'SHA-256' = 'db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e']","pattern_type":"stix","valid_from":"2026-09-11T05:30:08.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/critical-cisco-fmc-flaws-actively-exploited/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cfa6125-2db3-4dac-9bec-85f13a6d7206","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: -QAD.exe Detection Name: Win.Tool.Procpatcher::1201 SHA256: 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811 MD5: f3e82419a43220a7a222fc01b7607adc Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cddb31bd-918c-4b23-8ee2-d11e387d4aa5","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: 001.exe Detection Name: W32.9F1F11A708-100.SBX.TG** SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f5edec4-7cd3-4139-b5e2-20b5a1da753a","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: sample.exe Detection Name: W32.C4DD71E347-95.SBX.TG SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc1749c9-6472-43a0-8591-a0e9eb82318d","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2e01f2a-ac8e-495d-9de9-ef71c49f95af","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: 0055df5.dll Detection Name: Auto.90B145.282358.in02 SHA256: c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 MD5: 9a47c4d379998ade2f8f99e23a630c06 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = 'c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0919514-23f0-4f04-a8db-c973f133a39e","created":"2026-09-10T14:43:37.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588","description":"Seen in \"SloppyRAT: A New Tool For Ransomware Attacks\" (Zscaler ThreatLabz). Context: application/json User-Agent: CommandExecutor/1.0 X-API-KEY: af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588 Content-Length: 49 Host: api.truesmart.org {\"machine_id\":\"a","pattern":"[file:hashes.'SHA-256' = 'af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588']","pattern_type":"stix","valid_from":"2026-09-10T14:43:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Zscaler ThreatLabz","url":"https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4e07cf2-1cd0-41c4-ba59-8dab95ebab69","created":"2026-09-10T13:33:41.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461","description":"Seen in \"Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware\" (Cyber Security News). Context: 079 91.214.78[.]118 UAT-11823 Netcat-based reverse shell C2 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware sample 43.204.2[.]142 UAT-1","pattern":"[file:hashes.'SHA-256' = '6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461']","pattern_type":"stix","valid_from":"2026-09-10T13:33:41.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/cisco-firewall-root-access-flaw/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0693ee6-e355-4c89-9bcc-8f310de9dac7","created":"2026-09-10T13:33:41.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d","description":"Seen in \"Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware\" (Cyber Security News). Context: e for all three observed campaigns. IOC Cluster Description b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp — web shell db491181ece3f319de6567ab6f6d","pattern":"[file:hashes.'SHA-256' = 'b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d']","pattern_type":"stix","valid_from":"2026-09-10T13:33:41.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/cisco-firewall-root-access-flaw/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--233a71e7-7f0b-4d06-a838-cf5086d3e3a9","created":"2026-09-10T13:33:41.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e","description":"Seen in \"Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware\" (Cyber Security News). Context: 54fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp — web shell db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd.jar — JAR-based command executor 89.34.96[.]5","pattern":"[file:hashes.'SHA-256' = 'db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e']","pattern_type":"stix","valid_from":"2026-09-10T13:33:41.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/cisco-firewall-root-access-flaw/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa311e14-4319-4347-bd0b-3ae22edb2de7","created":"2026-09-10T12:58:10.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e","description":"Seen in \"Redtail Payload Analysis &#x5b;Guest Diary&#x5d;, (Wed, Sep 9th)\" (SANS Internet Storm Center). Context: le analyzed in this article has the following SHA-256 hash: 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e Dynamic analysis showed that the payload did considerably m","pattern":"[file:hashes.'SHA-256' = '63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e']","pattern_type":"stix","valid_from":"2026-09-10T12:58:10.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"SANS Internet Storm Center","url":"https://isc.sans.edu/diary/rss/33326"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0c96e4a-6cf3-4e4c-8008-5c6b7bdcc156","created":"2026-09-10T10:00:43.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 40228af4d9a094f0fef2d7a303a3b6a689c4b4eba2fa9f7da5125b81d2d68ec8","description":"Seen in \"The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE\" (Palo Alto Unit 42). Context: pod - image : ghcr .io / spiffe / spire - agent @ sha256 : 40228af4d9a094f0fef2d7a303a3b6a689c4b4eba2fa9f7da5125b81d2d68ec8 \\ \" type : \\ \" k8s \\ \" value : \\ \" pod - label : app : clie","pattern":"[file:hashes.'SHA-256' = '40228af4d9a094f0fef2d7a303a3b6a689c4b4eba2fa9f7da5125b81d2d68ec8']","pattern_type":"stix","valid_from":"2026-09-10T10:00:43.000Z","labels":["auto-extracted","research"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb119b88-ce32-42a0-8b31-08ecfc267064","created":"2026-09-10T10:00:43.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7e1e73513947053f6ee40746fc498b1fb4f285cf175fa8336f08a38e209bda38","description":"Seen in \"The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE\" (Palo Alto Unit 42). Context: 176_ab5c_4f2a_b5f3_3c7e4c91a9ca .slice / cri - containerd - 7e1e73513947053f6ee40746fc498b1fb4f285cf175fa8336f08a38e209bda38.scope We copied this path to a mock cgroup path and wrote o","pattern":"[file:hashes.'SHA-256' = '7e1e73513947053f6ee40746fc498b1fb4f285cf175fa8336f08a38e209bda38']","pattern_type":"stix","valid_from":"2026-09-10T10:00:43.000Z","labels":["auto-extracted","research"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2b0b708-244e-4999-928b-3f7071d7bec5","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: rprint associated with 178.128.87[.]160 Certificate SHA-256 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c Certificate fingerprint associated with 178.128.87[.]160 Fi","pattern":"[file:hashes.'SHA-256' = '46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b846fa8-6375-43be-aba2-0b267420cf5b","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: erprint associated with 165.22.184[.]26 Certificate SHA-256 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 Certificate fingerprint associated with 178.128.87[.]160 Ce","pattern":"[file:hashes.'SHA-256' = '4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b26cf95-84e1-4ca0-a154-f5e52811a087","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: SockTz installers and campaign scripts Certificate SHA-256 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 Certificate fingerprint associated with 165.22.184[.]26 Cer","pattern":"[file:hashes.'SHA-256' = '7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--13d6edb1-aa28-4be2-bbfb-cfb2ddb5f1a9","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: zilian financial campaign malware or tool hash File SHA-256 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec Brazilian financial campaign malware or tool hash URL hxxp[","pattern":"[file:hashes.'SHA-256' = '87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--293cbdd2-64d4-4852-a040-fe530640fe7d","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: e fingerprint associated with 178.128.87[.]160 File SHA-256 a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 Brazilian financial campaign malware or tool hash File SHA-","pattern":"[file:hashes.'SHA-256' = 'a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e07b41b0-7c08-4c7c-b334-c288c7a6f0f5","created":"2026-09-10T07:01:43.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11","description":"Seen in \"Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.\" (GBHackers). Context: stores. IOCs Indicator Type Value Description SHA-256 Hash 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 Native Mach-O Stager Binary MD5 Hash 9678f71ea4cccbc3d511dc","pattern":"[file:hashes.'SHA-256' = '9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11']","pattern_type":"stix","valid_from":"2026-09-10T07:01:43.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/clickfix-lures-target-macos/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--057247a5-31f7-4996-8a12-17582f76f546","created":"2026-09-10T06:02:43.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c","description":"Seen in \"Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America\" (GBHackers). Context: ingerprint Corresponding Host/IP m-doxa-apodo.duckdns[.]org 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c 178.128.87[.]160 m-doxa-geo.duckdns[.]org 4e218e70afdbb1162","pattern":"[file:hashes.'SHA-256' = '46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c']","pattern_type":"stix","valid_from":"2026-09-10T06:02:43.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/llm-powered-cyberattacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1a12bc5-d23f-43e3-b289-ce0d4372fe3e","created":"2026-09-10T06:02:43.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5","description":"Seen in \"Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America\" (GBHackers). Context: bec02f63776d3899c 178.128.87[.]160 m-doxa-geo.duckdns[.]org 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 178.128.87[.]160 m-doxa-intel.duckdns[.]org 7d766942ef34542","pattern":"[file:hashes.'SHA-256' = '4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5']","pattern_type":"stix","valid_from":"2026-09-10T06:02:43.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/llm-powered-cyberattacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fadebee1-ead4-49ce-ad59-ab6999e21998","created":"2026-09-10T06:02:43.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8","description":"Seen in \"Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America\" (GBHackers). Context: b83c0e863a8fee5 178.128.87[.]160 m-doxa-intel.duckdns[.]org 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 165.22.184[.]26 Note: IP addresses and domains are intentio","pattern":"[file:hashes.'SHA-256' = '7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8']","pattern_type":"stix","valid_from":"2026-09-10T06:02:43.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/llm-powered-cyberattacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dd15a4a-08e5-496a-b615-e2a06f15ea2d","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 3d2cd6b697c40adfee1a4f6fe18f004 SHA256 dist.zip August 2026 353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee SHA256 background.js August 2026 secboxes[.]com Domain TA41","pattern":"[file:hashes.'SHA-256' = '353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c2abba6-44f9-4d11-b496-a9e4c64717d8","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: ploitation. Ioc TA412 Indicator Type Description First Seen 779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d SHA256 driver-html.js(BlueMoon exploit JavaScript) August 2","pattern":"[file:hashes.'SHA-256' = '779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--52f2317f-eae3-47e1-b039-cc79bfa429fd","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 09fba35d782b SHA256 BlueMoon exploit JavaScript August 2026 7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288 SHA256 ChromeUpdate.exe (or msgbox.exe) August 2026 e950d03","pattern":"[file:hashes.'SHA-256' = '7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea78d21e-52df-4220-8b32-4a2e54894498","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 1f82288 SHA256 ChromeUpdate.exe (or msgbox.exe) August 2026 e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004 SHA256 dist.zip August 2026 353b5bd2780c1b0c07c1283d83cf16c","pattern":"[file:hashes.'SHA-256' = 'e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d7c61bc-b90f-4eb5-a975-bf1bfa6bd075","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 256 driver-html.js(BlueMoon exploit JavaScript) August 2026 ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b SHA256 BlueMoon exploit JavaScript August 2026 7d6f6dcb17a4","pattern":"[file:hashes.'SHA-256' = 'ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6598d891-d75e-4137-a05f-106085de315b","created":"2026-09-09T16:08:59.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461","description":"Seen in \"Active exploitation of Cisco Secure Firewall Management Center vulnerabilities\" (Cisco Talos). Context: 9. 91.214.78[.]118 UAT-11823 NetCat-based reverse shell C2. 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware. 43.204.2[.]142 UAT-11988 A","pattern":"[file:hashes.'SHA-256' = '6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461']","pattern_type":"stix","valid_from":"2026-09-09T16:08:59.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ee0271-a93f-4c8c-9f70-8c826d686ccc","created":"2026-09-09T16:08:59.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d","description":"Seen in \"Active exploitation of Cisco Secure Firewall Management Center vulnerabilities\" (Cisco Talos). Context: ble on our GitHub repository here . IOC Cluster Description B037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home[.]jsp – web shell. Db491181ece3f319de6567ab6","pattern":"[file:hashes.'SHA-256' = 'b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d']","pattern_type":"stix","valid_from":"2026-09-09T16:08:59.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ca4840a-8af8-4e63-902f-a5d270b3e300","created":"2026-09-09T16:08:59.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e","description":"Seen in \"Active exploitation of Cisco Secure Firewall Management Center vulnerabilities\" (Cisco Talos). Context: d0fdfd07162cb4eb2acbef77d UAT-12197 home[.]jsp – web shell. Db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd[.]jar – JAR-based command executor. 89.34.96[","pattern":"[file:hashes.'SHA-256' = 'db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e']","pattern_type":"stix","valid_from":"2026-09-09T16:08:59.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b95468be-b725-4224-8009-b217b7eba37f","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: ode payload used to deploy the Go reverse TCP proxy SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 Unpacked Go-based reverse TCP proxy executable WebSocket C2","pattern":"[file:hashes.'SHA-256' = '1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--06454bd7-aad2-4f64-b079-ce7fca6f140f","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: ation.google Amatera build during C2 communications SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 ZIP archive containing the DLL side-loading package File na","pattern":"[file:hashes.'SHA-256' = '279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccb1773f-51b6-41e5-9e95-a7eb24690fdd","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: ce\\DCRCVDRV_U Driver device exposed by DCRCVDrv.sys SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 Shellcode payload used to deploy the Go reverse TCP proxy S","pattern":"[file:hashes.'SHA-256' = '643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb4b8bc6-fa81-4a95-8287-eac5ae86d3b3","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: g ZIP payload retrieved by the PowerShell installer SHA-256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b ZIP archive containing the unauthorized remote-access deplo","pattern":"[file:hashes.'SHA-256' = 'bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--187afb14-ea54-457f-a48e-c502bd0fbd02","created":"2026-09-09T14:07:24.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7","description":"Seen in \"Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7 NodeRabbit-related sample identified by PolySwarm SHA-256 3","pattern":"[file:hashes.'SHA-256' = '123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7']","pattern_type":"stix","valid_from":"2026-09-09T14:07:24.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-use-fake-linkedin-job-offers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f1ea7de-64ed-4214-aef9-32567e381616","created":"2026-09-09T14:07:24.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00","description":"Seen in \"Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs\" (Cyber Security News). Context: 7 NodeRabbit-related sample identified by PolySwarm SHA-256 307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00 NodeRabbit-related sample identified by PolySwarm Note: IP","pattern":"[file:hashes.'SHA-256' = '307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00']","pattern_type":"stix","valid_from":"2026-09-09T14:07:24.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-use-fake-linkedin-job-offers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--95a9ad9f-a248-4c1f-bbc2-ba00495068a5","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 28a3eadc0b509386cae200993b33673b343c Gigabud sample SHA-256 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3 Vwork sample SHA-256 66499653c0fff78d81db5dc319b9aaa0288dc5","pattern":"[file:hashes.'SHA-256' = '0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aca5e24-8097-4300-9e97-2cf14976d7a1","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 1009dda5b93ed3d1cead527b02d1317426bc Gigabud sample SHA-256 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud sample SHA-256 9ca27df7938f12794bab0847434482955ca9","pattern":"[file:hashes.'SHA-256' = '112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2108a67a-27f2-47b1-aae9-f895f7346265","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 82955ca9adea714a34afd315c7a7be522611 Gigabud sample SHA-256 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud sample SHA-256 0710ca983741bf6a95db1b6960c1985e45b1","pattern":"[file:hashes.'SHA-256' = '1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2aa0cd7f-264f-4a27-9bf3-ca7dd55332bc","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 7986e52f913f4b5ff960ddea26075ff621ae Gigabud sample SHA-256 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud sample SHA-256 112fefc9348fa4acbb82d54d9688c96dd567","pattern":"[file:hashes.'SHA-256' = '4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--937893e8-5770-42c7-9928-0b63dae4bfde","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: a73660c0ee810eb Modified banking application sample SHA-256 61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc Modified banking application sample Android package net.yy.","pattern":"[file:hashes.'SHA-256' = '61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--15a74449-2269-4806-b598-11e9042cd81e","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: c1985e45b10f276e5b26f4fae3157db283d1f3 Vwork sample SHA-256 66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb Modified banking application sample SHA-256 61274cf9f49e04e","pattern":"[file:hashes.'SHA-256' = '66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3245370c-fab1-42a5-8e5e-7a291c3052f5","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud sample SHA-256 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud sample SHA-256 1f5d99864564c088a3260e54ad1728a3eadc","pattern":"[file:hashes.'SHA-256' = '9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b25cd579-45f3-488a-9a13-aaf76fba59ab","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 1bc772c8383a4149d23a5425b13475e2d501 Gigabud sample SHA-256 ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud sample SHA-256 4fff28eecc0ab6303e4948df77671009dda5","pattern":"[file:hashes.'SHA-256' = 'ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--87f52494-3114-4cdf-9912-6018d69d209c","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud sample SHA-256 ae6f6eeba2bd4cc948d24610d9447986e52f","pattern":"[file:hashes.'SHA-256' = 'b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a41ac03e-e78c-42a5-818e-f421a02f5ed9","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: ( 7c1d255d0efefde6 ) ScreenConnect.ClientSetup.exe SHA256: 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b Initial payload: rogue ScreenConnect installer HideCursor.e","pattern":"[file:hashes.'SHA-256' = '41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce433b9e-1b9c-49f2-9b7a-178e00102773","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: sion binary ScreenConnect Client (9c1aea531ba4c511) SHA256: 9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991 Rogue RMM: initial ScreenConnect instance ScreenConnect Cli","pattern":"[file:hashes.'SHA-256' = '9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a97c006a-924a-4236-9568-270fcb6e42a4","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: ct instance ScreenConnect Client (7c1d255d0efefde6) SHA256: f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 Rogue RMM: secondary rogue ScreenConnect instance Incident","pattern":"[file:hashes.'SHA-256' = 'f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6e19099-49ea-4292-a452-c1b17e51702b","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: yload: rogue ScreenConnect installer HideCursor.exe SHA256: fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2 Defense evasion binary ScreenConnect Client (9c1aea531ba4c5","pattern":"[file:hashes.'SHA-256' = 'fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--118dffbb-fd31-405d-9f61-f7eea9ad243e","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3 Note: IP addresses and domains are intentionally defanged (","pattern":"[file:hashes.'SHA-256' = '0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c80a7e8-5229-41ec-b94b-2d819668f03d","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud 9ca27df7938f12794bab0847434482955ca9adea714a34afd31","pattern":"[file:hashes.'SHA-256' = '112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f03b9a7-3158-4480-add3-320e0e8748c5","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 2794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae","pattern":"[file:hashes.'SHA-256' = '1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--68fdf566-bffe-43ee-bbc1-978db61c73dc","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f","pattern":"[file:hashes.'SHA-256' = '4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ede4aa2-4c1f-4388-a95e-7cf636e136f7","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae2009","pattern":"[file:hashes.'SHA-256' = '9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--80c27b9e-81ff-4680-8965-8f96a592588e","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527","pattern":"[file:hashes.'SHA-256' = 'ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ff69339-f7d3-4c4d-85fb-8d204f062817","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: horized transfers. IOCs Malware Family SHA-256 Hash Gigabud b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960dde","pattern":"[file:hashes.'SHA-256' = 'b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a66238d-b398-4e3c-b205-f24c59c9d1d9","created":"2026-09-09T08:50:44.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9","description":"Seen in \"PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory\" (Security Affairs). Context: upgrade images. The SHA-256 hash of the analyzed sample is 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 . F5 has published remediation and compromise assessment gu","pattern":"[file:hashes.'SHA-256' = '26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9']","pattern_type":"stix","valid_from":"2026-09-09T08:50:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Security Affairs","url":"https://securityaffairs.com/198746/malware/poisonedrefresh-a-fileless-linux-rootkit-that-injects-php-web-shells-into-f5-big-ip-apm-server-memory.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ec18149-27ba-43fe-8966-68c039fef0ea","created":"2026-09-09T07:47:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a","description":"Seen in \"Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners\" (Cyber Security News). Context: identifier observed in the RDP certificate TLS fingerprint 420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a Pinned mining-pool certificate fingerprint in the newest pa","pattern":"[file:hashes.'SHA-256' = '420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a']","pattern_type":"stix","valid_from":"2026-09-09T07:47:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-turn-redis-servers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7f135d7-377e-49a8-a7ae-79c399305c90","created":"2026-09-09T07:36:49.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9","description":"Seen in \"F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans\" (The Hacker News). Context: inding a socket under /run, or starting /bin/bash SHA-256 : 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 File, weak on its own : changes to the three .php3 scripts.","pattern":"[file:hashes.'SHA-256' = '26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9']","pattern_type":"stix","valid_from":"2026-09-09T07:36:49.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--64ce0ad5-ba40-47f3-b77e-291d95e64ff2","created":"2026-09-08T13:28:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3","description":"Seen in \"Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs\" (GBHackers). Context: 13d3a54ffb35caed529bff49055ec5 Malicious MSI loader package 0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3 Second-stage DLL (rundll32-loaded module) Note: IP addresse","pattern":"[file:hashes.'SHA-256' = '0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3']","pattern_type":"stix","valid_from":"2026-09-08T13:28:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/it-support-on-microsoft-teams/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d74e779c-1065-41a5-8337-a0ad97daabdf","created":"2026-09-08T13:28:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d","description":"Seen in \"Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs\" (GBHackers). Context: e compromised machine. IOCs Indicator (SHA-256) Description 4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d Malicious MSI loader package (silent msiexec install) a4d14","pattern":"[file:hashes.'SHA-256' = '4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d']","pattern_type":"stix","valid_from":"2026-09-08T13:28:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/it-support-on-microsoft-teams/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--da32edbe-9939-46b8-ae75-c612f3935a91","created":"2026-09-08T13:28:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676","description":"Seen in \"Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs\" (GBHackers). Context: c389d Malicious MSI loader package (silent msiexec install) a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676 Malicious MSI loader package cc6d0f3f47afeba018173604e34f52","pattern":"[file:hashes.'SHA-256' = 'a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676']","pattern_type":"stix","valid_from":"2026-09-08T13:28:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/it-support-on-microsoft-teams/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e383452-e5b7-4c2a-a590-8030366a5c54","created":"2026-09-08T13:28:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5","description":"Seen in \"Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs\" (GBHackers). Context: f019d0110e31a44bb70fc77d1d1676 Malicious MSI loader package cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5 Malicious MSI loader package 0d2fc28af246f62f27e49207d1f64e","pattern":"[file:hashes.'SHA-256' = 'cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5']","pattern_type":"stix","valid_from":"2026-09-08T13:28:45.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/it-support-on-microsoft-teams/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--987efad7-acb2-4007-81bd-25735253be10","created":"2026-09-08T10:01:07.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92","description":"Seen in \"ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager\" (Cisco Talos). Context: most recently observed response was a ZIP archive, SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92. The archive included the file \"platform_experience_helper.","pattern":"[file:hashes.'SHA-256' = '279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92']","pattern_type":"stix","valid_from":"2026-09-08T10:01:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/clearfake-webdav-infection-chain/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--33755e41-b4e3-4e8b-a620-3ebb99ff3b8a","created":"2026-09-06T13:46:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e","description":"Seen in \"Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”\" (Security Affairs). Context: b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd (launch.sh), and 6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e (serve.py). Follow me on Twitter: @securityaffairs and Face","pattern":"[file:hashes.'SHA-256' = '6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e']","pattern_type":"stix","valid_from":"2026-09-06T13:46:02.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Security Affairs","url":"https://securityaffairs.com/198538/security/your-mikrotik-router-may-already-be-compromised-look-for-ssh-user-2.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2be892d9-d0d9-44b6-b265-72463a117529","created":"2026-09-06T13:46:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d","description":"Seen in \"Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”\" (Security Affairs). Context: nalysis: IPs 82.192.72[.]4 and 103.102.31[.]18; file hashes 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d (ftpsrv.py), 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b","pattern":"[file:hashes.'SHA-256' = '6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d']","pattern_type":"stix","valid_from":"2026-09-06T13:46:02.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Security Affairs","url":"https://securityaffairs.com/198538/security/your-mikrotik-router-may-already-be-compromised-look-for-ssh-user-2.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dacf0028-6edb-4d19-9a19-71514706ffe2","created":"2026-09-06T13:46:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd","description":"Seen in \"Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”\" (Security Affairs). Context: b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d (ftpsrv.py), 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd (launch.sh), and 6dca83338d60467b65b7789d4d59754e40a7aaa36f","pattern":"[file:hashes.'SHA-256' = '972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd']","pattern_type":"stix","valid_from":"2026-09-06T13:46:02.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Security Affairs","url":"https://securityaffairs.com/198538/security/your-mikrotik-router-may-already-be-compromised-look-for-ssh-user-2.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--31689418-fee0-4424-a18a-f3dbdc4493c1","created":"2026-09-06T08:34:20.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa","description":"Seen in \"Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner\" (The Hacker News). Context: 4987ae9eb21bf5e67de5e9461b09655165ee4 (REVSTEALER) SHA-256: 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa (ProManager) SHA-256: 7c08cf409194056a8517865e5d3433d1499bb","pattern":"[file:hashes.'SHA-256' = '13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa']","pattern_type":"stix","valid_from":"2026-09-06T08:34:20.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d7070c5-14c1-487e-97db-89ca6cb9af8d","created":"2026-09-06T08:34:20.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2","description":"Seen in \"Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner\" (The Hacker News). Context: 3433d1499bb8262263b55b49b8b07d9d182fcb (WinUpdate) SHA-256: 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2 (SoftManager) SHA-256: c66d2b77b9e85c53391891212413ad9a99eb","pattern":"[file:hashes.'SHA-256' = '14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2']","pattern_type":"stix","valid_from":"2026-09-06T08:34:20.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--69090bec-8ac2-44fa-9b5e-b2a08de1bb1f","created":"2026-09-06T08:34:20.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb","description":"Seen in \"Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner\" (The Hacker News). Context: 580b453ce4987acbe2c4c4d04833f55ebccfa (ProManager) SHA-256: 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb (WinUpdate) SHA-256: 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de","pattern":"[file:hashes.'SHA-256' = '7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb']","pattern_type":"stix","valid_from":"2026-09-06T08:34:20.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9a1cc94-879d-4088-92b5-2492322a7272","created":"2026-09-06T08:34:20.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4","description":"Seen in \"Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner\" (The Hacker News). Context: eset is enough. Selected indicators of compromise: SHA-256: adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4 (REVSTEALER) SHA-256: 13d7237d7289e67c2d806a65d52580b453ce4","pattern":"[file:hashes.'SHA-256' = 'adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4']","pattern_type":"stix","valid_from":"2026-09-06T08:34:20.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b2b7ee0-1962-41ee-868a-6c4b283a9a3a","created":"2026-09-06T08:34:20.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5","description":"Seen in \"Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner\" (The Hacker News). Context: 7dd9fff7de9719c2a43ad123fe843dd4e4e2 (SoftManager) SHA-256: c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5 (LockAppHost) Domain: monitor5.roast-core85[.]click (REVSTE","pattern":"[file:hashes.'SHA-256' = 'c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5']","pattern_type":"stix","valid_from":"2026-09-06T08:34:20.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--00cd6182-7ef1-4e0d-bc57-c026c2e25ada","created":"2026-09-05T20:14:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 251fabd50d7b18a8b5e1b3ef5d64e7198c17244778f6461fb1ab07f6169bf220","description":"Seen in \"Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores\" (The Hacker News). Context: 705adec1902a1d06ef (on disk on both Disrex stores) SHA-256: 251fabd50d7b18a8b5e1b3ef5d64e7198c17244778f6461fb1ab07f6169bf220 (running in memory on one Disrex store) Domain: 247.cdnflar","pattern":"[file:hashes.'SHA-256' = '251fabd50d7b18a8b5e1b3ef5d64e7198c17244778f6461fb1ab07f6169bf220']","pattern_type":"stix","valid_from":"2026-09-05T20:14:47.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--007112f3-b668-4220-9f36-7fc1132aeb90","created":"2026-09-05T20:14:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8334b434fa3fe9f59cebe9609b11e0b1fd19d10212c45c705adec1902a1d06ef","description":"Seen in \"Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores\" (The Hacker News). Context: b2b05d81391285eebc2af664641a26a7 (Sansec's sample) SHA-256: 8334b434fa3fe9f59cebe9609b11e0b1fd19d10212c45c705adec1902a1d06ef (on disk on both Disrex stores) SHA-256: 251fabd50d7b18a8b5","pattern":"[file:hashes.'SHA-256' = '8334b434fa3fe9f59cebe9609b11e0b1fd19d10212c45c705adec1902a1d06ef']","pattern_type":"stix","valid_from":"2026-09-05T20:14:47.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b78630d8-9e54-4cad-9d44-6d08cff5ecee","created":"2026-09-05T20:14:47.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7","description":"Seen in \"Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores\" (The Hacker News). Context: /gvfsd-user , with a variant pointing at /tmp/.kw_ SHA-256: e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 (Sansec's sample) SHA-256: 8334b434fa3fe9f59cebe9609b11e0b1","pattern":"[file:hashes.'SHA-256' = 'e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7']","pattern_type":"stix","valid_from":"2026-09-05T20:14:47.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2145e17e-292d-4834-9b36-36952992a556","created":"2026-09-05T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d","description":"Seen in \"StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack\" (Sansec (Magento / e-commerce security)). Context: a3e82 kworker-linux-arm64 (new build, 209.141.43.95) sha256 1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d chronyd variant, captured from /proc/<pid>/exe /tmp/.kw_<ra","pattern":"[file:hashes.'SHA-256' = '1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d']","pattern_type":"stix","valid_from":"2026-09-05T00:00:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Sansec (Magento / e-commerce security)","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--82d419cd-ae57-4ab0-98a1-9413eca526fe","created":"2026-09-05T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e","description":"Seen in \"StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack\" (Sansec (Magento / e-commerce security)). Context: 60e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420 sha256 4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e kworker-linux-x64 (new build, 209.141.43.95), 2270031 bytes","pattern":"[file:hashes.'SHA-256' = '4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e']","pattern_type":"stix","valid_from":"2026-09-05T00:00:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Sansec (Magento / e-commerce security)","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f0eefde-12f4-4825-921a-74e6a9b569bd","created":"2026-09-05T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420","description":"Seen in \"StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack\" (Sansec (Magento / e-commerce security)). Context: 61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 sha256 b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420 sha256 4352cabaa451e5a894535fbcc4d46628701303322a13745cb547","pattern":"[file:hashes.'SHA-256' = 'b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420']","pattern_type":"stix","valid_from":"2026-09-05T00:00:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Sansec (Magento / e-commerce security)","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9283b000-550f-4261-9245-c50134893c0c","created":"2026-09-05T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82","description":"Seen in \"StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack\" (Sansec (Magento / e-commerce security)). Context: -linux-x64 (new build, 209.141.43.95), 2270031 bytes sha256 d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82 kworker-linux-arm64 (new build, 209.141.43.95) sha256 1a337","pattern":"[file:hashes.'SHA-256' = 'd2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82']","pattern_type":"stix","valid_from":"2026-09-05T00:00:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Sansec (Magento / e-commerce security)","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9c3c946-456a-4bd1-9f22-af700ed294fe","created":"2026-09-05T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d61217ca0bca83204302fa7b41935ce36f73764559c156d5c980f2fedddffb6e","description":"Seen in \"StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack\" (Sansec (Magento / e-commerce security)). Context: d second attacker (unrelated tooling, same victims): sha256 d61217ca0bca83204302fa7b41935ce36f73764559c156d5c980f2fedddffb6e PHP dropper pub/media/catalog/product/cache/ss_<10hex>/sync","pattern":"[file:hashes.'SHA-256' = 'd61217ca0bca83204302fa7b41935ce36f73764559c156d5c980f2fedddffb6e']","pattern_type":"stix","valid_from":"2026-09-05T00:00:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Sansec (Magento / e-commerce security)","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--86f65ccd-b1f5-4f0f-87c0-7922b9222a19","created":"2026-09-05T00:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7","description":"Seen in \"StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack\" (Sansec (Magento / e-commerce security)). Context: n-requests 2.15.0 on the implant operator's requests sha256 e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 sha256 b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4e","pattern":"[file:hashes.'SHA-256' = 'e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7']","pattern_type":"stix","valid_from":"2026-09-05T00:00:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Sansec (Magento / e-commerce security)","url":"https://sansec.io/research/stylesmuggler-0day"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--302de228-6bb4-474d-9d2e-8b3aa447801c","created":"2026-09-04T14:51:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5","description":"Seen in \"New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic\" (The Hacker News). Context: 9142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 SHA-256 - 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5 The Hacker News confirmed on September 4 that none of the s","pattern":"[file:hashes.'SHA-256' = '4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5']","pattern_type":"stix","valid_from":"2026-09-04T14:51:13.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--913cc9b7-5b5a-4a33-9885-7c4a8d5647be","created":"2026-09-04T14:51:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558","description":"Seen in \"New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic\" (The Hacker News). Context: File - /var/lib/snapd/g580 File - /tmp/jasper-log SHA-256 - 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 SHA-256 - 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1","pattern":"[file:hashes.'SHA-256' = '72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558']","pattern_type":"stix","valid_from":"2026-09-04T14:51:13.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4568a5ab-25af-4141-b8f0-b50000b7e16d","created":"2026-09-04T12:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe","description":"Seen in \"DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors\" (Rapid7 Blog). Context: audit / audit.log , cmd.log , secure , syslog , auth.log . 09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe and fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ad","pattern":"[file:hashes.'SHA-256' = '09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe']","pattern_type":"stix","valid_from":"2026-09-04T12:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Rapid7 Blog","url":"https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3f3c840-bb9c-4efb-ad37-fa69df07dc97","created":"2026-09-04T12:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5","description":"Seen in \"DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors\" (Rapid7 Blog). Context: hrough it, completing the watering-hole loop. SSH keylogger 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5 intercepts legitimate users' plaintext passwords and saves","pattern":"[file:hashes.'SHA-256' = '4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5']","pattern_type":"stix","valid_from":"2026-09-04T12:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Rapid7 Blog","url":"https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3002750a-79fc-43a3-94c3-8368ad1750df","created":"2026-09-04T12:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91","description":"Seen in \"DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors\" (Rapid7 Blog). Context: ound to be delivered by a stager. CurlRAT Stager The stager 5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91 starts by decrypting its configuration strings using a 1-by","pattern":"[file:hashes.'SHA-256' = '5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91']","pattern_type":"stix","valid_from":"2026-09-04T12:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Rapid7 Blog","url":"https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--66d842eb-ad71-4a21-994c-ed34a03e0343","created":"2026-09-04T12:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558","description":"Seen in \"DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors\" (Rapid7 Blog). Context: er. Ted backdoor The TA recompiled the HAProxy build 2.8.12 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 (18MB) to include a custom plugin (named ted_plugin ) leavi","pattern":"[file:hashes.'SHA-256' = '72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558']","pattern_type":"stix","valid_from":"2026-09-04T12:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Rapid7 Blog","url":"https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc213532-9475-465a-839d-9e4049a269df","created":"2026-09-04T12:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c","description":"Seen in \"DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors\" (Rapid7 Blog). Context: ryption (Figure 8). Figure 8: Default configuration curlRAT 8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c ⠀ The atd_get_info() is a recon routine likely used to deci","pattern":"[file:hashes.'SHA-256' = '8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c']","pattern_type":"stix","valid_from":"2026-09-04T12:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Rapid7 Blog","url":"https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cca9c477-c0a4-4676-8764-4de4ee25f5d0","created":"2026-09-04T12:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61","description":"Seen in \"DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors\" (Rapid7 Blog). Context: d4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe and fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61 are a different variant of the stager that fetches backdoor","pattern":"[file:hashes.'SHA-256' = 'fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61']","pattern_type":"stix","valid_from":"2026-09-04T12:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Rapid7 Blog","url":"https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--14052e48-a72f-4b2d-8722-d4dc4f99ba39","created":"2026-09-04T12:00:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3","description":"Seen in \"DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors\" (Rapid7 Blog). Context: epath used to hide config/staging files. As for the stager, feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3 starts by decrypting configuration strings using a 1-byte X","pattern":"[file:hashes.'SHA-256' = 'feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3']","pattern_type":"stix","valid_from":"2026-09-04T12:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Rapid7 Blog","url":"https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe6b9aa9-d963-46eb-ba52-0c3dcb02f98d","created":"2026-09-03T18:00:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 228c316455d5ed69232adcbe9acd033092f200014cfa7ed40d6c382f07b19b82","description":"Seen in \"The story behind the intelligence\" (Cisco Talos). Context: 001.exe Detection Name: W32.9F1F11A708-100.SBX.TG** SHA256: 228c316455d5ed69232adcbe9acd033092f200014cfa7ed40d6c382f07b19b82 MD5: 61e046145ee5cf45aeb033cd71e8b07c Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '228c316455d5ed69232adcbe9acd033092f200014cfa7ed40d6c382f07b19b82']","pattern_type":"stix","valid_from":"2026-09-03T18:00:13.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/the-story-behind-the-intelligence/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--480b8aa0-a770-4a01-ac15-9ff54e4b7663","created":"2026-09-03T18:00:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55","description":"Seen in \"The story behind the intelligence\" (Cisco Talos). Context: sample.exe Detection Name: W32.C4DD71E347-95.SBX.TG SHA256: 38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55 MD5: 41444d7018601b599beac0c60ed1bf83 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55']","pattern_type":"stix","valid_from":"2026-09-03T18:00:13.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/the-story-behind-the-intelligence/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8244ee24-af41-4123-a68c-71bbf6c827fe","created":"2026-09-03T18:00:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f","description":"Seen in \"The story behind the intelligence\" (Cisco Talos). Context: content.js Detection Name: W32.38D053135D-95.SBX.TG SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f']","pattern_type":"stix","valid_from":"2026-09-03T18:00:13.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/the-story-behind-the-intelligence/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6b934ca-38f0-4a4a-b4a6-2361316e025a","created":"2026-09-03T18:00:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507","description":"Seen in \"The story behind the intelligence\" (Cisco Talos). Context: lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507']","pattern_type":"stix","valid_from":"2026-09-03T18:00:13.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/the-story-behind-the-intelligence/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--54b1663d-a84e-4832-898d-a803aa590d75","created":"2026-09-03T18:00:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91","description":"Seen in \"The story behind the intelligence\" (Cisco Talos). Context: tGuard.exe Detection Name: W32.228C316455-95.SBX.TG SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = 'a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91']","pattern_type":"stix","valid_from":"2026-09-03T18:00:13.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/the-story-behind-the-intelligence/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--717a803e-ec4d-4a0a-8834-c3d5292fef57","created":"2026-09-03T18:00:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2","description":"Seen in \"The story behind the intelligence\" (Cisco Talos). Context: .exe Detection Name: Win.Dropper.Miner::95.sbx.tg** SHA256: c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 MD5: 9a47c4d379998ade2f8f99e23a630c06 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = 'c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2']","pattern_type":"stix","valid_from":"2026-09-03T18:00:13.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/the-story-behind-the-intelligence/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8332fc47-0ae9-4326-98b4-82c2fc73f0dc","created":"2026-09-03T10:00:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c","description":"Seen in \"Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America\" (Palo Alto Unit 42). Context: 648aa4e0425b83c0e863a8fee5 5 178.128.87[.]160 June 19, 2026 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c 5 178.128.87[.]160 Table 2. Certificate procurement timelin","pattern":"[file:hashes.'SHA-256' = '46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c']","pattern_type":"stix","valid_from":"2026-09-03T10:00:58.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcc438ce-d9bb-4385-98c7-1fa236afd9e7","created":"2026-09-03T10:00:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5","description":"Seen in \"Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America\" (Palo Alto Unit 42). Context: 23187010c4d38dbf88fcb40bf8 1 165.22.184[.]26 April 20, 2026 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 5 178.128.87[.]160 June 19, 2026 46ac289ce0c13666de616446f5","pattern":"[file:hashes.'SHA-256' = '4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5']","pattern_type":"stix","valid_from":"2026-09-03T10:00:58.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3e786e7-9b63-4b5a-a133-72e349420e09","created":"2026-09-03T10:00:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8","description":"Seen in \"Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America\" (Palo Alto Unit 42). Context: ture. Date Certificate SHA-256 Hash SANs Host Feb. 27, 2026 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 1 165.22.184[.]26 April 20, 2026 4e218e70afdbb116209ec0ebe8","pattern":"[file:hashes.'SHA-256' = '7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8']","pattern_type":"stix","valid_from":"2026-09-03T10:00:58.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--97e25a24-e422-42d8-ace9-7714aa481875","created":"2026-09-03T10:00:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec","description":"Seen in \"Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America\" (Palo Alto Unit 42). Context: cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec URL: hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe Additiona","pattern":"[file:hashes.'SHA-256' = '87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec']","pattern_type":"stix","valid_from":"2026-09-03T10:00:58.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f873d31-5b09-4e68-accf-988aff1d1c77","created":"2026-09-03T10:00:58.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996","description":"Seen in \"Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America\" (Palo Alto Unit 42). Context: 65.22.184[.]26 Brazilian Financial Campaign SHA-256 hashes: a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee","pattern":"[file:hashes.'SHA-256' = 'a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996']","pattern_type":"stix","valid_from":"2026-09-03T10:00:58.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--19d3f7fb-5c72-4951-a2cc-aad08de4d799","created":"2026-09-03T08:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020","description":"Seen in \"Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity\" (Huntress). Context: s. 7a4d7d66502d4260 Malicious ScreenConnect ID 1.vbs SHA256 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020 VBScript file executed through wscript.exe . 2.vbs SHA256 d","pattern":"[file:hashes.'SHA-256' = '08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020']","pattern_type":"stix","valid_from":"2026-09-03T08:50:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/rogue-screenconnect-installations"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--88a1e9e3-4633-485b-a656-88bc0ecf0808","created":"2026-09-03T08:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66","description":"Seen in \"Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity\" (Huntress). Context: 0 VBScript file executed through wscript.exe . 3.vbs SHA256 110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66 VBScript file executed through wscript.exe . 4.vbs SHA256 d","pattern":"[file:hashes.'SHA-256' = '110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66']","pattern_type":"stix","valid_from":"2026-09-03T08:50:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/rogue-screenconnect-installations"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f4b5df0-0d3d-483c-b65e-d8a04765cc6d","created":"2026-09-03T08:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260","description":"Seen in \"Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity\" (Huntress). Context: 836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260 VBScript file executed through wscript.exe . 3.vbs SHA256 1","pattern":"[file:hashes.'SHA-256' = '19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260']","pattern_type":"stix","valid_from":"2026-09-03T08:50:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/rogue-screenconnect-installations"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5193fe9-8bb9-47c1-876d-80388045c21e","created":"2026-09-03T08:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457","description":"Seen in \"Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity\" (Huntress). Context: 0 VBScript file executed through wscript.exe . 2.vbs SHA256 de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117","pattern":"[file:hashes.'SHA-256' = 'de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457']","pattern_type":"stix","valid_from":"2026-09-03T08:50:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/rogue-screenconnect-installations"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b891e0fe-d3e6-48fe-b4b3-ddb67fa15028","created":"2026-09-03T08:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede","description":"Seen in \"Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity\" (Huntress). Context: 6 VBScript file executed through wscript.exe . 4.vbs SHA256 de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede VBScript file executed through wscript.exe . Trojan:Script/","pattern":"[file:hashes.'SHA-256' = 'de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede']","pattern_type":"stix","valid_from":"2026-09-03T08:50:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/rogue-screenconnect-installations"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b43493c-a1b9-4122-985c-ff28555b0844","created":"2026-09-03T08:50:00.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de","description":"Seen in \"Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity\" (Huntress). Context: Defender Detection for 4.vbs WindowsServiceHost.vbs SHA256 ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de VBScript file executed through wscript.exe . WindowsService","pattern":"[file:hashes.'SHA-256' = 'ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de']","pattern_type":"stix","valid_from":"2026-09-03T08:50:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/rogue-screenconnect-installations"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--95c29281-43b2-414b-b32e-1f634ef82c6f","created":"2026-09-02T13:12:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48","description":"Seen in \"BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access\" (The Hacker News). Context: n the official scanner , whose retrieved-script SHA-256 was 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48 when checked on September 2, 2026. Contact support before r","pattern":"[file:hashes.'SHA-256' = '73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48']","pattern_type":"stix","valid_from":"2026-09-02T13:12:45.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a271bb0d-96c9-4740-a3f1-b3363306b0de","created":"2026-09-02T13:12:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7","description":"Seen in \"BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access\" (The Hacker News). Context: oad - /usr/lib/jvm/.cache/jre-runtime.dat Payload SHA-256 - b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7 Marker file - /usr/lib/jvm/.cache/.installed Marker file -","pattern":"[file:hashes.'SHA-256' = 'b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7']","pattern_type":"stix","valid_from":"2026-09-02T13:12:45.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--34a8ec87-b588-4318-aa34-802bc6a59ba2","created":"2026-09-02T12:22:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3","description":"Seen in \"Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control\" (The Hacker News). Context: ckage - io.base.one887 Application - StrεαmTV Pro SHA-256 - ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3 Package - io.meat.hint Application - Sistema de vídeo C2 IP","pattern":"[file:hashes.'SHA-256' = 'ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3']","pattern_type":"stix","valid_from":"2026-09-02T12:22:02.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1ada3e3-91f2-4228-bfff-94ec1e577040","created":"2026-09-02T12:22:02.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c","description":"Seen in \"Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control\" (The Hacker News). Context: d the following indicators of compromise (IoCs) - SHA-256 - e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c Package - io.base.one887 Application - StrεαmTV Pro SHA-256","pattern":"[file:hashes.'SHA-256' = 'e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c']","pattern_type":"stix","valid_from":"2026-09-02T12:22:02.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--64f06b80-db70-4fde-b248-c15454acef90","created":"2026-09-01T22:48:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17","description":"Seen in \"Counterfeit installers to system compromise: Tracking a deceptive software download campaign\" (Microsoft Security Blog). Context: ocessFolderPath C:\\ProgramData\\.exe InitiatingProcessSHA256 1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17 InitiatingProcessCommandLine \".exe\" InitiatingProcessCreati","pattern":"[file:hashes.'SHA-256' = '1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17']","pattern_type":"stix","valid_from":"2026-09-01T22:48:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Microsoft Security Blog","url":"https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--190bd997-e707-490a-92e9-9d4b4f823a32","created":"2026-09-01T22:48:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8","description":"Seen in \"Counterfeit installers to system compromise: Tracking a deceptive software download campaign\" (Microsoft Security Blog). Context: ogram Files (x86)\\72q1o6\\40gK5T.exe InitiatingProcessSHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8 InitiatingProcessCommandLine \"40gK5T.exe\" InitiatingProcess","pattern":"[file:hashes.'SHA-256' = '6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8']","pattern_type":"stix","valid_from":"2026-09-01T22:48:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Microsoft Security Blog","url":"https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eee0cb16-cbf2-47c6-8336-a59c2913a850","created":"2026-09-01T21:30:18.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 47d2908c4dd7f6f5eb4a8ef4306077b10315c44231f4bacd2bb811b245561911","description":"Seen in \"Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)\" (SANS Internet Storm Center). Context: e: Zip archive data, at least v2.0 to extract SHA-256 hash: 47d2908c4dd7f6f5eb4a8ef4306077b10315c44231f4bacd2bb811b245561911 File size: 1,553 bytes File name: 868283789726483.lNk File","pattern":"[file:hashes.'SHA-256' = '47d2908c4dd7f6f5eb4a8ef4306077b10315c44231f4bacd2bb811b245561911']","pattern_type":"stix","valid_from":"2026-09-01T21:30:18.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"SANS Internet Storm Center","url":"https://isc.sans.edu/diary/rss/33300"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e83c13a7-4a08-495a-914d-85820412786b","created":"2026-09-01T21:30:18.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a6044786991afdb9d42ceb350943987765a7d0e8537369b2092e3f019c0f63ca","description":"Seen in \"Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)\" (SANS Internet Storm Center). Context: he infection, doesn't appear to be malicious: SHA-256 hash: a6044786991afdb9d42ceb350943987765a7d0e8537369b2092e3f019c0f63ca File size: 266,242 bytes File type: PE32+ executable (DLL)","pattern":"[file:hashes.'SHA-256' = 'a6044786991afdb9d42ceb350943987765a7d0e8537369b2092e3f019c0f63ca']","pattern_type":"stix","valid_from":"2026-09-01T21:30:18.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"SANS Internet Storm Center","url":"https://isc.sans.edu/diary/rss/33300"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--170ac591-c666-41f4-b254-32e4f60d079b","created":"2026-09-01T21:30:18.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cc44782356cb0effc528a7ab22c19ab360a55ebbbe01feb0967031aa191c5869","description":"Seen in \"Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)\" (SANS Internet Storm Center). Context: d zip archive and extracted Windows shortcut: SHA-256 hash: cc44782356cb0effc528a7ab22c19ab360a55ebbbe01feb0967031aa191c5869 File size: 1,661 bytes File name: 868283789726483.zip File","pattern":"[file:hashes.'SHA-256' = 'cc44782356cb0effc528a7ab22c19ab360a55ebbbe01feb0967031aa191c5869']","pattern_type":"stix","valid_from":"2026-09-01T21:30:18.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"SANS Internet Storm Center","url":"https://isc.sans.edu/diary/rss/33300"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--85824184-f0b0-40dd-925f-6852c453d5d1","created":"2026-09-01T21:30:18.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f62a958faf0491b2b2803be2ee69b664b58e4a1261f64e8530cdc1a3ff666aa4","description":"Seen in \"Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)\" (SANS Internet Storm Center). Context: It script for the persistent Guildma malware: SHA-256 hash: f62a958faf0491b2b2803be2ee69b664b58e4a1261f64e8530cdc1a3ff666aa4 File size: 277,874 bytes File type: Data File location: C:\\","pattern":"[file:hashes.'SHA-256' = 'f62a958faf0491b2b2803be2ee69b664b58e4a1261f64e8530cdc1a3ff666aa4']","pattern_type":"stix","valid_from":"2026-09-01T21:30:18.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"SANS Internet Storm Center","url":"https://isc.sans.edu/diary/rss/33300"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c56d3ecb-0e7f-47ab-a079-15d1a69c5590","created":"2026-08-19T12:06:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2548f5b1613f6ebba2ff589c7b3416ccdd066b73644d4d212232beb1cecd9c31","description":"Seen in \"Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices\" (Palo Alto Unit 42). Context: 38b360d8a836c038da4920e8c1ae620988b120613c0b1f MIPS-ELF nvr 2548f5b1613f6ebba2ff589c7b3416ccdd066b73644d4d212232beb1cecd9c31 Shell script Pty1 a4ba50129408f9f52ddabe5bfd5bfb46aea0ca48f","pattern":"[file:hashes.'SHA-256' = '2548f5b1613f6ebba2ff589c7b3416ccdd066b73644d4d212232beb1cecd9c31']","pattern_type":"stix","valid_from":"2026-08-19T12:06:09.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--64bffe7d-b0f1-40d1-a918-f7857d38321b","created":"2026-08-19T12:06:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 492780a9ac9f03305538b360d8a836c038da4920e8c1ae620988b120613c0b1f","description":"Seen in \"Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices\" (Palo Alto Unit 42). Context: s.shadow.mods[.]net Samples Filename SHA256 File type tty0 492780a9ac9f03305538b360d8a836c038da4920e8c1ae620988b120613c0b1f MIPS-ELF nvr 2548f5b1613f6ebba2ff589c7b3416ccdd066b73644d4d","pattern":"[file:hashes.'SHA-256' = '492780a9ac9f03305538b360d8a836c038da4920e8c1ae620988b120613c0b1f']","pattern_type":"stix","valid_from":"2026-08-19T12:06:09.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a31c8a90-473d-44af-820d-002ea183ad13","created":"2026-08-19T12:06:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 72123c51bcdf8c1784654d9e2470e69131872407408aa3cf775ea0ace87bb9a0","description":"Seen in \"Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices\" (Palo Alto Unit 42). Context: c04ae2ae8f2792711203de50d3d16de3a9f83baaf5435 MIPS-ELF Pty5 72123c51bcdf8c1784654d9e2470e69131872407408aa3cf775ea0ace87bb9a0 ARM-ELF Pty6 cee20e79f20d35b95645f0cbda1897302e6e554c50f3e6","pattern":"[file:hashes.'SHA-256' = '72123c51bcdf8c1784654d9e2470e69131872407408aa3cf775ea0ace87bb9a0']","pattern_type":"stix","valid_from":"2026-08-19T12:06:09.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dae9d9da-cd7b-4b25-b757-2368463fe924","created":"2026-08-19T12:06:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7325742dc0d939542d4c04ae2ae8f2792711203de50d3d16de3a9f83baaf5435","description":"Seen in \"Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices\" (Palo Alto Unit 42). Context: abe5bfd5bfb46aea0ca48fb616f495f2610b2f1729687 MIPS-ELF Pty3 7325742dc0d939542d4c04ae2ae8f2792711203de50d3d16de3a9f83baaf5435 MIPS-ELF Pty5 72123c51bcdf8c1784654d9e2470e69131872407408aa","pattern":"[file:hashes.'SHA-256' = '7325742dc0d939542d4c04ae2ae8f2792711203de50d3d16de3a9f83baaf5435']","pattern_type":"stix","valid_from":"2026-08-19T12:06:09.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dacc0f56-71b5-4cc3-a1c5-b73c07c57960","created":"2026-08-19T12:06:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a4ba50129408f9f52ddabe5bfd5bfb46aea0ca48fb616f495f2610b2f1729687","description":"Seen in \"Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices\" (Palo Alto Unit 42). Context: c7b3416ccdd066b73644d4d212232beb1cecd9c31 Shell script Pty1 a4ba50129408f9f52ddabe5bfd5bfb46aea0ca48fb616f495f2610b2f1729687 MIPS-ELF Pty3 7325742dc0d939542d4c04ae2ae8f2792711203de50d3","pattern":"[file:hashes.'SHA-256' = 'a4ba50129408f9f52ddabe5bfd5bfb46aea0ca48fb616f495f2610b2f1729687']","pattern_type":"stix","valid_from":"2026-08-19T12:06:09.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb66a244-8ca9-4973-b77f-5a75f5709821","created":"2026-08-19T12:06:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cee20e79f20d35b95645f0cbda1897302e6e554c50f3e6754ce9293e3c1ba11c","description":"Seen in \"Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices\" (Palo Alto Unit 42). Context: 654d9e2470e69131872407408aa3cf775ea0ace87bb9a0 ARM-ELF Pty6 cee20e79f20d35b95645f0cbda1897302e6e554c50f3e6754ce9293e3c1ba11c ARM-ELF daymon dc52a1193ecf6096192f771ae663de6e0389840cb5ce","pattern":"[file:hashes.'SHA-256' = 'cee20e79f20d35b95645f0cbda1897302e6e554c50f3e6754ce9293e3c1ba11c']","pattern_type":"stix","valid_from":"2026-08-19T12:06:09.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5410785-4965-43a6-9166-4579e269ea74","created":"2026-08-19T12:06:09.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: dc52a1193ecf6096192f771ae663de6e0389840cb5ceb7b979091333ce6f7f02","description":"Seen in \"Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices\" (Palo Alto Unit 42). Context: f0cbda1897302e6e554c50f3e6754ce9293e3c1ba11c ARM-ELF daymon dc52a1193ecf6096192f771ae663de6e0389840cb5ceb7b979091333ce6f7f02 ARM-ELF","pattern":"[file:hashes.'SHA-256' = 'dc52a1193ecf6096192f771ae663de6e0389840cb5ceb7b979091333ce6f7f02']","pattern_type":"stix","valid_from":"2026-08-19T12:06:09.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c8c15b2-642b-4609-bea1-69737524af7f","created":"2026-08-19T12:05:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358","description":"Seen in \"Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self\" (Palo Alto Unit 42). Context: aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0412e4 14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c1952","pattern":"[file:hashes.'SHA-256' = '14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358']","pattern_type":"stix","valid_from":"2026-08-19T12:05:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b9457bb-ae0e-489f-bedd-843a5dacf137","created":"2026-08-19T12:05:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b","description":"Seen in \"Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self\" (Palo Alto Unit 42). Context: 1d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b C2 servers eleethub[.]com irc.eleethub[.]com ghost.eleethub","pattern":"[file:hashes.'SHA-256' = '6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b']","pattern_type":"stix","valid_from":"2026-08-19T12:05:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--03c75950-2ce0-48d9-8782-a0cbb3b5e75b","created":"2026-08-19T12:05:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7ed8fc4ad8014da327278b6afc26a2b4d4c8326a681be2d2b33fb2386eade3c6","description":"Seen in \"Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self\" (Palo Alto Unit 42). Context: nets targeting IoT devices Indicators of Compromise Samples 7ed8fc4ad8014da327278b6afc26a2b4d4c8326a681be2d2b33fb2386eade3c6 dbef55cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187","pattern":"[file:hashes.'SHA-256' = '7ed8fc4ad8014da327278b6afc26a2b4d4c8326a681be2d2b33fb2386eade3c6']","pattern_type":"stix","valid_from":"2026-08-19T12:05:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--694367db-1ae6-4cd8-853e-e8f9aa50e0c9","created":"2026-08-19T12:05:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d9001aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0412e4","description":"Seen in \"Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self\" (Palo Alto Unit 42). Context: 5cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187e8ef6 d9001aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0412e4 14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd","pattern":"[file:hashes.'SHA-256' = 'd9001aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0412e4']","pattern_type":"stix","valid_from":"2026-08-19T12:05:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--17d63895-dcc1-4dbf-b233-d5680c8f4097","created":"2026-08-19T12:05:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: dbef55cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187e8ef6","description":"Seen in \"Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self\" (Palo Alto Unit 42). Context: c4ad8014da327278b6afc26a2b4d4c8326a681be2d2b33fb2386eade3c6 dbef55cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187e8ef6 d9001aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0","pattern":"[file:hashes.'SHA-256' = 'dbef55cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187e8ef6']","pattern_type":"stix","valid_from":"2026-08-19T12:05:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ee7dade-394a-45d4-bcbe-70c45340c4cd","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0039231b2fd5e5a3d86ae3b626d35b8fed7f2887a58e32b480ac82cd82150f7c","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 41b1 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.mpsl 0039231b2fd5e5a3d86ae3b626d35b8fed7f2887a58e32b480ac82cd82150f7c Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.ppc 9d55a","pattern":"[file:hashes.'SHA-256' = '0039231b2fd5e5a3d86ae3b626d35b8fed7f2887a58e32b480ac82cd82150f7c']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--de842734-810d-4f97-94fa-ea8da9ad872a","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 02d48570f1089e2e7f4f9256bb033136c773834af31054e477e094e48cba110e","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 0f30 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.m68k 02d48570f1089e2e7f4f9256bb033136c773834af31054e477e094e48cba110e Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.mips 45ff","pattern":"[file:hashes.'SHA-256' = '02d48570f1089e2e7f4f9256bb033136c773834af31054e477e094e48cba110e']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--849e3c04-028d-4f37-be75-46fee990489a","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 02f08ccc4a4136c89276135664267e08f1bb6795842a84c06c15478d3c3101e6","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 80a5 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.sh4 02f08ccc4a4136c89276135664267e08f1bb6795842a84c06c15478d3c3101e6 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.x86 f467","pattern":"[file:hashes.'SHA-256' = '02f08ccc4a4136c89276135664267e08f1bb6795842a84c06c15478d3c3101e6']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c8cf9ea-f55d-4ae3-b4a0-4434f29fee26","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 05102e5abb23c761426c2c0f19f70f650938ea9e9295ccbb92349513c1d26c63","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 8684e17 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.mips 05102e5abb23c761426c2c0f19f70f650938ea9e9295ccbb92349513c1d26c63 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.mpsl cc996d1","pattern":"[file:hashes.'SHA-256' = '05102e5abb23c761426c2c0f19f70f650938ea9e9295ccbb92349513c1d26c63']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbdd61b2-a47b-4d43-aa0a-e3460ab898d5","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 087fc3206ddb94e80118e7e7f0215c88409a0071b657d21071e15b7917f7cc4e","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 3e61 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.arm6 087fc3206ddb94e80118e7e7f0215c88409a0071b657d21071e15b7917f7cc4e Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.arm7 33f7","pattern":"[file:hashes.'SHA-256' = '087fc3206ddb94e80118e7e7f0215c88409a0071b657d21071e15b7917f7cc4e']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--24fa3dcf-75d2-4d68-b7a8-845af3d778e1","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0a664a74fcc00910170edcd5f548569b40c2c5d58fc5ced1f475dbe938684e17","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 5da833f Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.m68k 0a664a74fcc00910170edcd5f548569b40c2c5d58fc5ced1f475dbe938684e17 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.mips 05102e5","pattern":"[file:hashes.'SHA-256' = '0a664a74fcc00910170edcd5f548569b40c2c5d58fc5ced1f475dbe938684e17']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--333c9702-da5d-4639-88a6-1bab27953634","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0bbdb062ecfae7e1b59084a5e5fe052908ecfdea7db0777a9c318e9e55fdb5ff","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 7d871 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.ppc 0bbdb062ecfae7e1b59084a5e5fe052908ecfdea7db0777a9c318e9e55fdb5ff Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.sh4 77a1f","pattern":"[file:hashes.'SHA-256' = '0bbdb062ecfae7e1b59084a5e5fe052908ecfdea7db0777a9c318e9e55fdb5ff']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--217cf761-5bfb-4f58-a0d6-f388c13d84f9","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0c4ec06f32d5f15846239d224d68086cbeaf513b63f0fcafa4eddd8e18a3d372","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: ea04b Mar 11, 2021 12:59 UTC 203[.]159.80.241/bins/dark.ppc 0c4ec06f32d5f15846239d224d68086cbeaf513b63f0fcafa4eddd8e18a3d372 Mar 11, 2021 12:30 UTC 203[.]159.80.241/bins/dark.sh4 2f590","pattern":"[file:hashes.'SHA-256' = '0c4ec06f32d5f15846239d224d68086cbeaf513b63f0fcafa4eddd8e18a3d372']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a073dc8-6586-48aa-85e4-82f01ea2a043","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1d9496814d35d9e302d7e99339e9730fc81c022bc085c0711b73ebad962cbc2b","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 2f4420a Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.mpsl 1d9496814d35d9e302d7e99339e9730fc81c022bc085c0711b73ebad962cbc2b Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.ppc 971b5a96","pattern":"[file:hashes.'SHA-256' = '1d9496814d35d9e302d7e99339e9730fc81c022bc085c0711b73ebad962cbc2b']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--11878cb0-cf27-4515-9bfd-3683f3e14059","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1e56f8ca44f84eff212805fa061ecb0f6fb8bc9499ff2e541ad3c43fb2f4420a","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 54d23ba Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.mips 1e56f8ca44f84eff212805fa061ecb0f6fb8bc9499ff2e541ad3c43fb2f4420a Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.mpsl 1d94968","pattern":"[file:hashes.'SHA-256' = '1e56f8ca44f84eff212805fa061ecb0f6fb8bc9499ff2e541ad3c43fb2f4420a']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f40cf38a-f84c-40ec-ac20-ac619b1aedf3","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2102b6a9f4b6745b0963ac3040945fb351c3d7df5b8e75dbc4ebf587c921998f","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: cbe Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm5 2102b6a9f4b6745b0963ac3040945fb351c3d7df5b8e75dbc4ebf587c921998f Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm6 bfd","pattern":"[file:hashes.'SHA-256' = '2102b6a9f4b6745b0963ac3040945fb351c3d7df5b8e75dbc4ebf587c921998f']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b0793b0-2ee9-4829-a4e0-fa9288124afc","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2a09719254934fe8ee8f200a0a7537d35a293fe1f8d0e396e23374e9b209f273","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: a75f6 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.x86 2a09719254934fe8ee8f200a0a7537d35a293fe1f8d0e396e23374e9b209f273","pattern":"[file:hashes.'SHA-256' = '2a09719254934fe8ee8f200a0a7537d35a293fe1f8d0e396e23374e9b209f273']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--77270efb-ba9f-4f5a-8ddd-1ae57c2f17b9","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2f590f5af68dd30cdd51de85cb55dd16160ffce16dd326b2ac4c85e0007fca51","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 3d372 Mar 11, 2021 12:30 UTC 203[.]159.80.241/bins/dark.sh4 2f590f5af68dd30cdd51de85cb55dd16160ffce16dd326b2ac4c85e0007fca51 Mar 11, 2021 12:30 UTC 203[.]159.80.241/bins/dark.m68k cd59","pattern":"[file:hashes.'SHA-256' = '2f590f5af68dd30cdd51de85cb55dd16160ffce16dd326b2ac4c85e0007fca51']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1f7e8aa-2be4-42b6-a61d-f08bf2b6e1c2","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 33f75999a3b4c354b6281399e541b97fd6463c5cd2ab13a538522d72a8870f30","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: cc4e Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.arm7 33f75999a3b4c354b6281399e541b97fd6463c5cd2ab13a538522d72a8870f30 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.m68k 02d4","pattern":"[file:hashes.'SHA-256' = '33f75999a3b4c354b6281399e541b97fd6463c5cd2ab13a538522d72a8870f30']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea7e8f35-65e7-407d-a9d1-5cb77ef3dcf0","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 38d8f2d17b3b676f5258a28b6b4093a1c3cdfa0d34d97c80d86686a3cff7ed55","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 83aa Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm7 38d8f2d17b3b676f5258a28b6b4093a1c3cdfa0d34d97c80d86686a3cff7ed55 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.m68k b066","pattern":"[file:hashes.'SHA-256' = '38d8f2d17b3b676f5258a28b6b4093a1c3cdfa0d34d97c80d86686a3cff7ed55']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c731e63c-ae53-4fbb-851f-c0a3f19e538d","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 3c47dceb9b8fbb0d40c3f1efa8ebc8d7dcf82aa0af46c4486ec3fc8ca29a83b2","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 689 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.mips 3c47dceb9b8fbb0d40c3f1efa8ebc8d7dcf82aa0af46c4486ec3fc8ca29a83b2 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.mpsl d31","pattern":"[file:hashes.'SHA-256' = '3c47dceb9b8fbb0d40c3f1efa8ebc8d7dcf82aa0af46c4486ec3fc8ca29a83b2']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--236b98fe-faee-421b-8996-5f48e6ad0b62","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 40808fb06796aeb740368b9bc322c12193d1bebb8e5eeddc420a98db6ac82689","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: a8d Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.m68k 40808fb06796aeb740368b9bc322c12193d1bebb8e5eeddc420a98db6ac82689 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.mips 3c4","pattern":"[file:hashes.'SHA-256' = '40808fb06796aeb740368b9bc322c12193d1bebb8e5eeddc420a98db6ac82689']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e2a57d0-1da4-4acd-bfbc-280404c22f5b","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4414bf4f41663a6458372bcc4743d6e50bbb2d40c26d71bcb945926c98cd5537","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: bf1e Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm6 4414bf4f41663a6458372bcc4743d6e50bbb2d40c26d71bcb945926c98cd5537 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm7 8d0b","pattern":"[file:hashes.'SHA-256' = '4414bf4f41663a6458372bcc4743d6e50bbb2d40c26d71bcb945926c98cd5537']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--565f63c1-f113-4bca-93d2-8680f98bdbcd","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 45ff08b1de872379f965d423a0f4e1f2e82f0ea8d101220b83d3aed3b2e7f1c9","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 110e Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.mips 45ff08b1de872379f965d423a0f4e1f2e82f0ea8d101220b83d3aed3b2e7f1c9 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.mpsl 85ac","pattern":"[file:hashes.'SHA-256' = '45ff08b1de872379f965d423a0f4e1f2e82f0ea8d101220b83d3aed3b2e7f1c9']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5e975b0-bce1-4a1e-bf05-8e8c075e376d","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4f69555ab71b49c2c1067f0907eb73b185327b57c566a8311ba9f9e58f4e85a5","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: c2 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.arm 4f69555ab71b49c2c1067f0907eb73b185327b57c566a8311ba9f9e58f4e85a5 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.mips a","pattern":"[file:hashes.'SHA-256' = '4f69555ab71b49c2c1067f0907eb73b185327b57c566a8311ba9f9e58f4e85a5']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1573aad0-c97a-4f6a-91f1-ac20736c04c8","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4f6a9d2c775e0ba38189390aa7975973209f8e703d6f974c2ab67c97ad263204","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: ba7d Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mpsl 4f6a9d2c775e0ba38189390aa7975973209f8e703d6f974c2ab67c97ad263204 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.ppc c2640","pattern":"[file:hashes.'SHA-256' = '4f6a9d2c775e0ba38189390aa7975973209f8e703d6f974c2ab67c97ad263204']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfd313fd-6756-4cd2-b7b4-bcae3044e32b","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 4fe20e73217d0bde39616ebf6f50f0f27882f939537561849f7b17968c5b8e30","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 4f5c25975e Feb 23, 2021 09:03 UTC 185[.]239.242.63/lolol.sh 4fe20e73217d0bde39616ebf6f50f0f27882f939537561849f7b17968c5b8e30 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.mpsl 6b1be","pattern":"[file:hashes.'SHA-256' = '4fe20e73217d0bde39616ebf6f50f0f27882f939537561849f7b17968c5b8e30']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cef3593-1e23-4fa6-8fa3-e2f291dd8c4d","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 515dc2fd8819c7fc82395acc4c7fb5b2903982a5f48bc26bc8d0235bc0664d1f","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: c07c8ec Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm6 515dc2fd8819c7fc82395acc4c7fb5b2903982a5f48bc26bc8d0235bc0664d1f Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm7 a9c4ea4","pattern":"[file:hashes.'SHA-256' = '515dc2fd8819c7fc82395acc4c7fb5b2903982a5f48bc26bc8d0235bc0664d1f']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--772f3873-a298-4cab-b778-9e72ac0a5edc","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 519b2d04e80c2cb7c000a3c00cb30098df363bd825281b2b7384d964b832df3b","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: be23 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm7 519b2d04e80c2cb7c000a3c00cb30098df363bd825281b2b7384d964b832df3b Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm6 7a57","pattern":"[file:hashes.'SHA-256' = '519b2d04e80c2cb7c000a3c00cb30098df363bd825281b2b7384d964b832df3b']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--427680fd-37a1-4e98-a91f-8c5f925b571c","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 528179f34ed9a6e69f582c23b3cbb50343164bf0e5995624a8d16f8b0df202e8","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 6b1287 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.sh4 528179f34ed9a6e69f582c23b3cbb50343164bf0e5995624a8d16f8b0df202e8 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.x86 f05d21","pattern":"[file:hashes.'SHA-256' = '528179f34ed9a6e69f582c23b3cbb50343164bf0e5995624a8d16f8b0df202e8']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cec70e5-4641-4245-84c0-7d3a48a7f838","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5446350c771766589e6d79e8185e10fcc0a6681eb76723b7f26dfef03c9080a5","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 8e8f Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.ppc 5446350c771766589e6d79e8185e10fcc0a6681eb76723b7f26dfef03c9080a5 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.sh4 02f0","pattern":"[file:hashes.'SHA-256' = '5446350c771766589e6d79e8185e10fcc0a6681eb76723b7f26dfef03c9080a5']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a178caf-0339-4080-8f01-299366bde256","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5525b282df49206e76e884ca0f86806ddc97ec08343bab1d9a98f029a2697b08","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 97521 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm 5525b282df49206e76e884ca0f86806ddc97ec08343bab1d9a98f029a2697b08 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm5 b82b","pattern":"[file:hashes.'SHA-256' = '5525b282df49206e76e884ca0f86806ddc97ec08343bab1d9a98f029a2697b08']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2aa885aa-9d48-4a30-bd0c-34c5fb0c2df3","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 554bee9f896a7a013804485894875348ff760b08ff7b0ae14c210e2b37da75f6","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 542b5 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.sh4 554bee9f896a7a013804485894875348ff760b08ff7b0ae14c210e2b37da75f6 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.x86 2a097","pattern":"[file:hashes.'SHA-256' = '554bee9f896a7a013804485894875348ff760b08ff7b0ae14c210e2b37da75f6']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a70af6ba-f26e-4c21-b547-4481d7d86ca1","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5715d9c632c646c856f2775de8e98c00cade29f7bfb6fbe33a5741b01e897521","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: c804b97c2d Feb 24, 2021 15:59 UTC 185[.]239.242.63/lolol.sh 5715d9c632c646c856f2775de8e98c00cade29f7bfb6fbe33a5741b01e897521 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm 5525b","pattern":"[file:hashes.'SHA-256' = '5715d9c632c646c856f2775de8e98c00cade29f7bfb6fbe33a5741b01e897521']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec3859fe-cfba-4320-8f8a-21c8c5569401","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5d7487a5d6febb015a21a98eddffc617cfc06453fe2a7dacac6e1719f56c56fb","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 4a13 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm5 5d7487a5d6febb015a21a98eddffc617cfc06453fe2a7dacac6e1719f56c56fb Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mpsl e9d0","pattern":"[file:hashes.'SHA-256' = '5d7487a5d6febb015a21a98eddffc617cfc06453fe2a7dacac6e1719f56c56fb']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffbb6ec6-4a30-4b17-b68c-eb899c709e17","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 60135a7817a0a1734c2e211a8613873548f4611fddc8666890f6a69860c43e61","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: A256 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.arm5 60135a7817a0a1734c2e211a8613873548f4611fddc8666890f6a69860c43e61 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.arm6 087f","pattern":"[file:hashes.'SHA-256' = '60135a7817a0a1734c2e211a8613873548f4611fddc8666890f6a69860c43e61']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a2592a8-0148-4bdb-aae6-f473714f478f","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 63e66d6f0ddf5fea5b1f71643bdb30f3fff4531c364b6fd1b0e0e0cfe5da833f","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: fbe004b8 Mar 5, 2021 14:13 UTC 45[.]133.1.133/bins/dark.ppc 63e66d6f0ddf5fea5b1f71643bdb30f3fff4531c364b6fd1b0e0e0cfe5da833f Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.m68k 0a664a7","pattern":"[file:hashes.'SHA-256' = '63e66d6f0ddf5fea5b1f71643bdb30f3fff4531c364b6fd1b0e0e0cfe5da833f']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b3c07e2-b165-4e3b-9d4b-95b8a2e47488","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 64f9bc6e925fd2f538c89fd8a8c25d11521b9fcc51c8c5308e9850c990bea04b","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 2ff4f Mar 11, 2021 13:12 UTC 203[.]159.80.241/bins/dark.x86 64f9bc6e925fd2f538c89fd8a8c25d11521b9fcc51c8c5308e9850c990bea04b Mar 11, 2021 12:59 UTC 203[.]159.80.241/bins/dark.ppc 0c4ec","pattern":"[file:hashes.'SHA-256' = '64f9bc6e925fd2f538c89fd8a8c25d11521b9fcc51c8c5308e9850c990bea04b']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--383d684b-03dc-4acf-ad7a-138343572d26","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 667640d293e4ce2287546fc2e0056ee14f414868bf5b77f72078096c516a9fb0","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: eac4 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mpsl 667640d293e4ce2287546fc2e0056ee14f414868bf5b77f72078096c516a9fb0 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.ppc beb0b","pattern":"[file:hashes.'SHA-256' = '667640d293e4ce2287546fc2e0056ee14f414868bf5b77f72078096c516a9fb0']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9db49a52-82f9-40e6-9a07-6391edb12477","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 66ea76a427b69f153486f962baff29d4a68393e985c7d88c94d773b25ad4964a","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 0302 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.m68k 66ea76a427b69f153486f962baff29d4a68393e985c7d88c94d773b25ad4964a Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mips def1","pattern":"[file:hashes.'SHA-256' = '66ea76a427b69f153486f962baff29d4a68393e985c7d88c94d773b25ad4964a']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cf4cb8a-920c-4cd8-9acd-4d7fb52eebe4","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6a68acd757fab908b2455c9b5882c25ab4a550121c2badb960b0a514a04a8d3d","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: e30 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/combo.txt 6a68acd757fab908b2455c9b5882c25ab4a550121c2badb960b0a514a04a8d3d Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.386 ba","pattern":"[file:hashes.'SHA-256' = '6a68acd757fab908b2455c9b5882c25ab4a550121c2badb960b0a514a04a8d3d']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bce1ce38-5ed9-4320-9a88-025abcc60926","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6b1bea5f17eb2c16815b8cb87d6e24e707248e5384fc4dd33c86c189657c73ff","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: b8e30 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.mpsl 6b1bea5f17eb2c16815b8cb87d6e24e707248e5384fc4dd33c86c189657c73ff Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.ppc 918395","pattern":"[file:hashes.'SHA-256' = '6b1bea5f17eb2c16815b8cb87d6e24e707248e5384fc4dd33c86c189657c73ff']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--130c8880-d3d2-416a-90eb-6a9939d593f0","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 73aaf3ce3e5ea7a598f01d727e8278ff64ff0067fc2f2b22387b09de64c2ff4f","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: efb8 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mips 73aaf3ce3e5ea7a598f01d727e8278ff64ff0067fc2f2b22387b09de64c2ff4f Mar 11, 2021 13:12 UTC 203[.]159.80.241/bins/dark.x86 64f9b","pattern":"[file:hashes.'SHA-256' = '73aaf3ce3e5ea7a598f01d727e8278ff64ff0067fc2f2b22387b09de64c2ff4f']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1ed2f75-ee52-43e1-9207-2dbeb593c4e6","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 73b35ddbf9784a6f6ebad7f5a1f4965daedc2f92cbb45a9cb76e61c0104bf553","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 10dd6 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.sh4 73b35ddbf9784a6f6ebad7f5a1f4965daedc2f92cbb45a9cb76e61c0104bf553 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.x86 a925f","pattern":"[file:hashes.'SHA-256' = '73b35ddbf9784a6f6ebad7f5a1f4965daedc2f92cbb45a9cb76e61c0104bf553']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6155af8-e67e-473b-a829-5eb2ed643414","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 74ab77e1069c6fb32925e89563c57f09c842cad0de6ab6b7c9ec2fa44d2641b1","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 6854 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.mips 74ab77e1069c6fb32925e89563c57f09c842cad0de6ab6b7c9ec2fa44d2641b1 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.mpsl 0039","pattern":"[file:hashes.'SHA-256' = '74ab77e1069c6fb32925e89563c57f09c842cad0de6ab6b7c9ec2fa44d2641b1']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--45ab425e-9d32-471e-b735-e1b42677832b","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 77a1f62dc76cc9ee2d924008a0fdcc329396021f027ebe1cfa468f9625c2455b","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: db5ff Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.sh4 77a1f62dc76cc9ee2d924008a0fdcc329396021f027ebe1cfa468f9625c2455b Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.x86 8d116","pattern":"[file:hashes.'SHA-256' = '77a1f62dc76cc9ee2d924008a0fdcc329396021f027ebe1cfa468f9625c2455b']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b0549ec-6be3-4159-a6c6-4231283390b6","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7a571f666c8f272cce1ee7ad75520a013bbed800e7d0c80a17804500a3474a13","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: df3b Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm6 7a571f666c8f272cce1ee7ad75520a013bbed800e7d0c80a17804500a3474a13 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm5 5d74","pattern":"[file:hashes.'SHA-256' = '7a571f666c8f272cce1ee7ad75520a013bbed800e7d0c80a17804500a3474a13']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--61e90df8-aed8-427b-868e-376f4e45c87b","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7aa437a562f3a956cf60fce652e6a0fb2d3c7cda0e5312c1a7fa62e177c45906","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 16629 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.sh4 7aa437a562f3a956cf60fce652e6a0fb2d3c7cda0e5312c1a7fa62e177c45906 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.x86 8e65d","pattern":"[file:hashes.'SHA-256' = '7aa437a562f3a956cf60fce652e6a0fb2d3c7cda0e5312c1a7fa62e177c45906']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--48f9ec65-fe3a-46b5-b036-cac224dc262d","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 80cd13bfcc2fc29096abf18525d17766700a6d25a9806e55c7b7de776cba0302","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 2f47 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm7 80cd13bfcc2fc29096abf18525d17766700a6d25a9806e55c7b7de776cba0302 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.m68k 66ea","pattern":"[file:hashes.'SHA-256' = '80cd13bfcc2fc29096abf18525d17766700a6d25a9806e55c7b7de776cba0302']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--600318f4-37ca-4b93-88fd-e329bb9017ac","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8524826a687491c6bfd161df3e4fb2f537f50ea32834d7710dcf3b788a5ddfc2","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.amd64 8524826a687491c6bfd161df3e4fb2f537f50ea32834d7710dcf3b788a5ddfc2 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.arm 4f","pattern":"[file:hashes.'SHA-256' = '8524826a687491c6bfd161df3e4fb2f537f50ea32834d7710dcf3b788a5ddfc2']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b4516fb-dac7-420f-aac0-7b66ae919974","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 85acead88180809d47524aac87d6f76799e7c0a1729d9614446be73aa8e7d871","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: f1c9 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.mpsl 85acead88180809d47524aac87d6f76799e7c0a1729d9614446be73aa8e7d871 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.ppc 0bbdb","pattern":"[file:hashes.'SHA-256' = '85acead88180809d47524aac87d6f76799e7c0a1729d9614446be73aa8e7d871']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--78a134c3-66ce-4f23-b164-71d85e45bfd0","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8cc6375f2eabe865e8400f27381a513a69e4100748458c3d2c706f3d4002bf1e","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 31cf Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm5 8cc6375f2eabe865e8400f27381a513a69e4100748458c3d2c706f3d4002bf1e Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm6 4414","pattern":"[file:hashes.'SHA-256' = '8cc6375f2eabe865e8400f27381a513a69e4100748458c3d2c706f3d4002bf1e']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb68a17d-4399-4fa4-9e69-ebf745f27bc5","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8d0beb4b143dc4a9543b4bc5d7f44a6771a973709aaf8c3a4754d120b99d0afd","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 5537 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm7 8d0beb4b143dc4a9543b4bc5d7f44a6771a973709aaf8c3a4754d120b99d0afd Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.m68k f977","pattern":"[file:hashes.'SHA-256' = '8d0beb4b143dc4a9543b4bc5d7f44a6771a973709aaf8c3a4754d120b99d0afd']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2f622fc-51cb-436c-9391-4eac1237a723","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8d11635019b077d36ce7de2a3ca9261f126e0ff5808f722fcb967e7cd000be23","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 2455b Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.x86 8d11635019b077d36ce7de2a3ca9261f126e0ff5808f722fcb967e7cd000be23 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm7 519b","pattern":"[file:hashes.'SHA-256' = '8d11635019b077d36ce7de2a3ca9261f126e0ff5808f722fcb967e7cd000be23']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ede007b-3251-4fae-bfc8-6abb9e4d8094","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8e65d7b16939834e1cd86b36b495924d34f10a8c477b53c9c8e648c804b97c2d","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 45906 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.x86 8e65d7b16939834e1cd86b36b495924d34f10a8c477b53c9c8e648c804b97c2d Feb 24, 2021 15:59 UTC 185[.]239.242.63/lolol.sh 5715d9c632","pattern":"[file:hashes.'SHA-256' = '8e65d7b16939834e1cd86b36b495924d34f10a8c477b53c9c8e648c804b97c2d']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--acc362d6-4382-411d-b7a7-44d6a3aa3c24","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 904b086dbf3e8f4dd1711d758d54675ce2d6002ff607a72d72d7e3aea612ba7d","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: b7e7 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mips 904b086dbf3e8f4dd1711d758d54675ce2d6002ff607a72d72d7e3aea612ba7d Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mpsl 4f6a","pattern":"[file:hashes.'SHA-256' = '904b086dbf3e8f4dd1711d758d54675ce2d6002ff607a72d72d7e3aea612ba7d']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--63cb3bda-80ee-431a-9841-f0df5f1a3acd","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 918395bac079ab747736246b9d84e66921774d3eb95bb47045704624646b1287","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 7c73ff Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.ppc 918395bac079ab747736246b9d84e66921774d3eb95bb47045704624646b1287 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.sh4 528179","pattern":"[file:hashes.'SHA-256' = '918395bac079ab747736246b9d84e66921774d3eb95bb47045704624646b1287']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--936fc984-18cf-4850-93c4-2dffb1088c28","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 971b5a96d84ca0d7dd906b639cd97a04835013be32356d09037cff64516c73bf","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 962cbc2b Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.ppc 971b5a96d84ca0d7dd906b639cd97a04835013be32356d09037cff64516c73bf Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.sh4 e2a6ac51","pattern":"[file:hashes.'SHA-256' = '971b5a96d84ca0d7dd906b639cd97a04835013be32356d09037cff64516c73bf']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8eb38534-2f89-47f3-9b0c-0777d6533f77","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9aa0ded21b8c21075a6ad24180befc47dbfeb3985a433f1baa6181ec945a19b9","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: a74093e2 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.x86 9aa0ded21b8c21075a6ad24180befc47dbfeb3985a433f1baa6181ec945a19b9 Mar 3, 2021 14:24 UTC 45[.]133.1.133/lolol.sh ecae298b18493","pattern":"[file:hashes.'SHA-256' = '9aa0ded21b8c21075a6ad24180befc47dbfeb3985a433f1baa6181ec945a19b9']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--20576ed9-f52f-4288-a02a-a6385dcaf47c","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 9d55aa1d9841be74cdc0c9d0a9fe2f20e0704ea30c721a7b2dcae02675416629","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 50f7c Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.ppc 9d55aa1d9841be74cdc0c9d0a9fe2f20e0704ea30c721a7b2dcae02675416629 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.sh4 7aa43","pattern":"[file:hashes.'SHA-256' = '9d55aa1d9841be74cdc0c9d0a9fe2f20e0704ea30c721a7b2dcae02675416629']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a24a9b2-da75-4c61-bb57-225209c3f607","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a447bb67be310702807ff148f53f2b4c64ddba0c37f92caf6acabdfaa9ad6603","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 37ca Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm5 a447bb67be310702807ff148f53f2b4c64ddba0c37f92caf6acabdfaa9ad6603 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm6 b212","pattern":"[file:hashes.'SHA-256' = 'a447bb67be310702807ff148f53f2b4c64ddba0c37f92caf6acabdfaa9ad6603']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--70d870cb-8fe5-4aa8-80df-7779bb105917","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a5c2b758da21d7895c7945de8684c9b27370af6c5bf48ce3d94626261982659f","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 5 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.mips a5c2b758da21d7895c7945de8684c9b27370af6c5bf48ce3d94626261982659f Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.mipsle","pattern":"[file:hashes.'SHA-256' = 'a5c2b758da21d7895c7945de8684c9b27370af6c5bf48ce3d94626261982659f']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--52c60bcf-5eed-4317-a00e-d7528a2dd646","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a5ca43106a713c4a8e978575b8685889c244501288b9fa7c7dc7f1e8c5ef1291","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: a7a641a2 Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.x86 a5ca43106a713c4a8e978575b8685889c244501288b9fa7c7dc7f1e8c5ef1291 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.m68k a6cb635","pattern":"[file:hashes.'SHA-256' = 'a5ca43106a713c4a8e978575b8685889c244501288b9fa7c7dc7f1e8c5ef1291']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e80e85eb-b436-41ce-a30c-1d117b3e464c","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a6cb6356432ca83467f6da2168be2aabbabe5d2f2dd4c01d6c4a93d01a57df53","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 5ef1291 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.m68k a6cb6356432ca83467f6da2168be2aabbabe5d2f2dd4c01d6c4a93d01a57df53 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.sh4 c686712f","pattern":"[file:hashes.'SHA-256' = 'a6cb6356432ca83467f6da2168be2aabbabe5d2f2dd4c01d6c4a93d01a57df53']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--56566fe3-4f9f-4b21-90cc-87eaabba8c6f","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a925f0486b33f3f05d610d33c5a4b6bb2d5531c89e804e001ec01c4f5c25975e","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: bf553 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.x86 a925f0486b33f3f05d610d33c5a4b6bb2d5531c89e804e001ec01c4f5c25975e Feb 23, 2021 09:03 UTC 185[.]239.242.63/lolol.sh 4fe20e7321","pattern":"[file:hashes.'SHA-256' = 'a925f0486b33f3f05d610d33c5a4b6bb2d5531c89e804e001ec01c4f5c25975e']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9d79e82-3e52-471b-972d-dcd479006237","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a9c4ea40b08ce4281c2dc9776355186dfc5649f9ec2b36c32fa5540f8d2aef2d","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 0664d1f Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm7 a9c4ea40b08ce4281c2dc9776355186dfc5649f9ec2b36c32fa5540f8d2aef2d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.m68k ac75cb7","pattern":"[file:hashes.'SHA-256' = 'a9c4ea40b08ce4281c2dc9776355186dfc5649f9ec2b36c32fa5540f8d2aef2d']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0202ec5f-f190-492a-b1bd-f84c615878eb","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ac75cb71c2f052141a238b8f7215d5a0956f7034cf90f231d228ce58254d23ba","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: d2aef2d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.m68k ac75cb71c2f052141a238b8f7215d5a0956f7034cf90f231d228ce58254d23ba Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.mips 1e56f8c","pattern":"[file:hashes.'SHA-256' = 'ac75cb71c2f052141a238b8f7215d5a0956f7034cf90f231d228ce58254d23ba']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ddc9af8-44e6-4b55-ac4e-fcfb86cfe29a","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b066b1c1d019fc97e3649b99ad10294783b13a12b67d34b9c8500e762c37b7e7","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: ed55 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.m68k b066b1c1d019fc97e3649b99ad10294783b13a12b67d34b9c8500e762c37b7e7 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mips 904b","pattern":"[file:hashes.'SHA-256' = 'b066b1c1d019fc97e3649b99ad10294783b13a12b67d34b9c8500e762c37b7e7']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--523af8d9-362d-4648-bfef-6e26eac5c025","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b2122c5a9c738d964fa770760db40d6708de377e2e671feccb836054ceda2f47","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 6603 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm6 b2122c5a9c738d964fa770760db40d6708de377e2e671feccb836054ceda2f47 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm7 80cd","pattern":"[file:hashes.'SHA-256' = 'b2122c5a9c738d964fa770760db40d6708de377e2e671feccb836054ceda2f47']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a477e7b0-6860-4fa2-bd9d-dbc2fa2d0186","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b37da8e6afa2b3223b1f8f73e6801cf3fed3c0f114cfb9c134b5f06322a337ca","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.mipsle b37da8e6afa2b3223b1f8f73e6801cf3fed3c0f114cfb9c134b5f06322a337ca Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm5 a447","pattern":"[file:hashes.'SHA-256' = 'b37da8e6afa2b3223b1f8f73e6801cf3fed3c0f114cfb9c134b5f06322a337ca']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c1f4522-a9be-43b1-ba62-497e6fa7c0c8","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b3a20c8dfa5adaa8247c4d2097f3cc8423b4e270c9735f616628bf9bde583cbe","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 2e780a7807a Feb 22, 2021 16:30 UTC 37[.]46.150.102/lolol.sh b3a20c8dfa5adaa8247c4d2097f3cc8423b4e270c9735f616628bf9bde583cbe Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm5 210","pattern":"[file:hashes.'SHA-256' = 'b3a20c8dfa5adaa8247c4d2097f3cc8423b4e270c9735f616628bf9bde583cbe']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--07359220-05d6-45eb-bbf7-38c66a30246d","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b82b8957a4397eae1061a74fb7a8014cbbcbe7064d4edf2e0b15233fd2ce8cca","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 7b08 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm5 b82b8957a4397eae1061a74fb7a8014cbbcbe7064d4edf2e0b15233fd2ce8cca Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm6 ec9d","pattern":"[file:hashes.'SHA-256' = 'b82b8957a4397eae1061a74fb7a8014cbbcbe7064d4edf2e0b15233fd2ce8cca']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--19fec1ca-6b6c-4ff7-823a-b1719369f72a","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: baedd59eba62c289dcb722588895eb165f4a1570b3c012efc3dcc60d3bdea521","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 3d Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.386 baedd59eba62c289dcb722588895eb165f4a1570b3c012efc3dcc60d3bdea521 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.amd64","pattern":"[file:hashes.'SHA-256' = 'baedd59eba62c289dcb722588895eb165f4a1570b3c012efc3dcc60d3bdea521']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fe6723e-32a7-4caf-9618-55e0137f8d91","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: beb0b7178b242f2dba21c3d91abf80e8738847b8086d2a42e9352738c83542b5","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: a9fb0 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.ppc beb0b7178b242f2dba21c3d91abf80e8738847b8086d2a42e9352738c83542b5 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.sh4 554be","pattern":"[file:hashes.'SHA-256' = 'beb0b7178b242f2dba21c3d91abf80e8738847b8086d2a42e9352738c83542b5']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a05cceb-3590-418a-8c09-8fc4e77aa2f7","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: bfd14a2f5c26501efb5d4010839b7d0bbc9a639d86ab5d12af663de598f15427","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 98f Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm6 bfd14a2f5c26501efb5d4010839b7d0bbc9a639d86ab5d12af663de598f15427 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm7 d9f","pattern":"[file:hashes.'SHA-256' = 'bfd14a2f5c26501efb5d4010839b7d0bbc9a639d86ab5d12af663de598f15427']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbc918ff-c63f-48b4-9dc6-425d0230ab74","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c26401490ab9343b023f1f89b39d8d32835a795117ef7d7a129871bc05010dd6","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 63204 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.ppc c26401490ab9343b023f1f89b39d8d32835a795117ef7d7a129871bc05010dd6 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.sh4 73b35","pattern":"[file:hashes.'SHA-256' = 'c26401490ab9343b023f1f89b39d8d32835a795117ef7d7a129871bc05010dd6']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c757df4c-b9e0-497b-9b60-896b9dcf76fb","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c686712f9be64e3d2957754ce181e5b4680b205cb6773b85b35df57983ed31cf","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 1a57df53 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.sh4 c686712f9be64e3d2957754ce181e5b4680b205cb6773b85b35df57983ed31cf Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm5 8cc6","pattern":"[file:hashes.'SHA-256' = 'c686712f9be64e3d2957754ce181e5b4680b205cb6773b85b35df57983ed31cf']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--326a6237-e042-4dee-8ded-cc37c305afce","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cc996d19c3e9b732b5f61fb7a2ad20a4f9e1fd7e62f484f15c7cc984a32dec01","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 1d26c63 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.mpsl cc996d19c3e9b732b5f61fb7a2ad20a4f9e1fd7e62f484f15c7cc984a32dec01 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.sh4 f05225fe","pattern":"[file:hashes.'SHA-256' = 'cc996d19c3e9b732b5f61fb7a2ad20a4f9e1fd7e62f484f15c7cc984a32dec01']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3317329-7584-4458-ab54-066b352e78bc","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: cd59c912b9af910db1880d6fb86cd6cb656477552cf2c2fc82e372bafbe004b8","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: ca51 Mar 11, 2021 12:30 UTC 203[.]159.80.241/bins/dark.m68k cd59c912b9af910db1880d6fb86cd6cb656477552cf2c2fc82e372bafbe004b8 Mar 5, 2021 14:13 UTC 45[.]133.1.133/bins/dark.ppc 63e66d6f","pattern":"[file:hashes.'SHA-256' = 'cd59c912b9af910db1880d6fb86cd6cb656477552cf2c2fc82e372bafbe004b8']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--be8e37ee-2ebe-4256-9bb7-14ba9883c8bb","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d31f1fecde01cc37950dc5b5330cd72e8ab1943f251bdfa5990f0d9d3a0a8e8f","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 3b2 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.mpsl d31f1fecde01cc37950dc5b5330cd72e8ab1943f251bdfa5990f0d9d3a0a8e8f Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.ppc 5446","pattern":"[file:hashes.'SHA-256' = 'd31f1fecde01cc37950dc5b5330cd72e8ab1943f251bdfa5990f0d9d3a0a8e8f']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d381ed44-ff74-4058-a5fc-543b3f264e4c","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d9f7504b3fe81f5264da5f23bdb7529f6d1dd713e28a92828180787729872a8d","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 427 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm7 d9f7504b3fe81f5264da5f23bdb7529f6d1dd713e28a92828180787729872a8d Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.m68k 408","pattern":"[file:hashes.'SHA-256' = 'd9f7504b3fe81f5264da5f23bdb7529f6d1dd713e28a92828180787729872a8d']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbbc93d4-b980-45ff-a995-555fea6963c7","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: def1959fae2d8a3dfe606126ceb9d5403deae97a4b4e216dc8e60354980eeac4","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 964a Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mips def1959fae2d8a3dfe606126ceb9d5403deae97a4b4e216dc8e60354980eeac4 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mpsl 6676","pattern":"[file:hashes.'SHA-256' = 'def1959fae2d8a3dfe606126ceb9d5403deae97a4b4e216dc8e60354980eeac4']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e49aa2ca-51ab-44d6-a482-78337ceadd62","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e2a6ac516ec8b5dcc76becc26cf992434882d490d8f2c9d7071298dba7a641a2","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 516c73bf Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.sh4 e2a6ac516ec8b5dcc76becc26cf992434882d490d8f2c9d7071298dba7a641a2 Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.x86 a5ca4310","pattern":"[file:hashes.'SHA-256' = 'e2a6ac516ec8b5dcc76becc26cf992434882d490d8f2c9d7071298dba7a641a2']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--67c55cd3-810f-40bd-be39-9ac50f1f77d8","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e9d056afe12210ddf98967e3291127ef9d0d24cbd36862ebc8b0726a565eefb8","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 56fb Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mpsl e9d056afe12210ddf98967e3291127ef9d0d24cbd36862ebc8b0726a565eefb8 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mips 73aa","pattern":"[file:hashes.'SHA-256' = 'e9d056afe12210ddf98967e3291127ef9d0d24cbd36862ebc8b0726a565eefb8']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0103bfbd-ff9f-4479-b16c-333471834d61","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ec9dc19758ba74fb254c69d2b60ae1012b1bd65390e936990e4bd8573bcb83aa","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 8cca Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm6 ec9dc19758ba74fb254c69d2b60ae1012b1bd65390e936990e4bd8573bcb83aa Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm7 38d8","pattern":"[file:hashes.'SHA-256' = 'ec9dc19758ba74fb254c69d2b60ae1012b1bd65390e936990e4bd8573bcb83aa']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--72240361-2bd8-4177-bd68-93d2f1853244","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ecae298b18493bf2366f6081e8215a474cce4554e07a7b2380a7f8e8a3a9a37d","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 181ec945a19b9 Mar 3, 2021 14:24 UTC 45[.]133.1.133/lolol.sh ecae298b18493bf2366f6081e8215a474cce4554e07a7b2380a7f8e8a3a9a37d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm5 fb940b1","pattern":"[file:hashes.'SHA-256' = 'ecae298b18493bf2366f6081e8215a474cce4554e07a7b2380a7f8e8a3a9a37d']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--af98ee88-fdd8-4f14-96be-4a5299ce6350","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f05225fec1fda7c6405e6961207ee12e198272d352144f516e970829a74093e2","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: a32dec01 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.sh4 f05225fec1fda7c6405e6961207ee12e198272d352144f516e970829a74093e2 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.x86 9aa0ded2","pattern":"[file:hashes.'SHA-256' = 'f05225fec1fda7c6405e6961207ee12e198272d352144f516e970829a74093e2']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--436ef915-1089-49fa-a131-8e9219029f86","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f05d21a5b4b72a761c1540f1400dff7e39f10ac1c8b843ec8986d2e780a7807a","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: f202e8 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.x86 f05d21a5b4b72a761c1540f1400dff7e39f10ac1c8b843ec8986d2e780a7807a Feb 22, 2021 16:30 UTC 37[.]46.150.102/lolol.sh b3a20c8dfa5","pattern":"[file:hashes.'SHA-256' = 'f05d21a5b4b72a761c1540f1400dff7e39f10ac1c8b843ec8986d2e780a7807a']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bfdce95-2a4f-4aa1-a5bd-8946d8dcc9bc","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f467e6335a4a0250a17d61b3d138b31998f3e6669e1fcd1c3648db1b44b55ffa","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 01e6 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.x86 f467e6335a4a0250a17d61b3d138b31998f3e6669e1fcd1c3648db1b44b55ffa Feb 22, 2021, 12:32 UTC 185[.]239.242.63/lolol.sh 4fe20e732","pattern":"[file:hashes.'SHA-256' = 'f467e6335a4a0250a17d61b3d138b31998f3e6669e1fcd1c3648db1b44b55ffa']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b02cfe57-1e4a-4816-bf86-9600777c85db","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f9770197d2254e6d5d4cb872b07dc25feb2994d4d5f0b3c854a98f9dfa3c6854","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 0afd Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.m68k f9770197d2254e6d5d4cb872b07dc25feb2994d4d5f0b3c854a98f9dfa3c6854 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.mips 74ab","pattern":"[file:hashes.'SHA-256' = 'f9770197d2254e6d5d4cb872b07dc25feb2994d4d5f0b3c854a98f9dfa3c6854']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e6e4a26-a5c4-48ef-951b-9e3e34395561","created":"2026-08-19T12:04:51.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fb940b1049e0e95c03adb7a2750347108cadf6b19ef4149a5103f7625c07c8ec","description":"Seen in \"New Mirai Variant Targeting Network Security Devices\" (Palo Alto Unit 42). Context: 3a9a37d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm5 fb940b1049e0e95c03adb7a2750347108cadf6b19ef4149a5103f7625c07c8ec Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm6 515dc2f","pattern":"[file:hashes.'SHA-256' = 'fb940b1049e0e95c03adb7a2750347108cadf6b19ef4149a5103f7625c07c8ec']","pattern_type":"stix","valid_from":"2026-08-19T12:04:51.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9e7c813-908d-4dfb-9370-450b8b12bcdc","created":"2026-08-19T12:04:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a","description":"Seen in \"FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications\" (Palo Alto Unit 42). Context: Windows executable file for FrostyGoop malware SHA256 hash: 2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a File size: 3.4 MB (3,359,232 bytes) File type: PE32+ execut","pattern":"[file:hashes.'SHA-256' = '2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a']","pattern_type":"stix","valid_from":"2026-08-19T12:04:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/frostygoop-malware-analysis/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f053f5ba-ba0c-4bf9-b222-d9f29e7cd951","created":"2026-08-19T12:04:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb","description":"Seen in \"FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications\" (Palo Alto Unit 42). Context: he two FrostyGoop samples have the following SHA256 hashes: 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fe","pattern":"[file:hashes.'SHA-256' = '5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb']","pattern_type":"stix","valid_from":"2026-08-19T12:04:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/frostygoop-malware-analysis/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cac3b46a-0630-4a4e-bfb4-00b67d0722e0","created":"2026-08-19T12:04:32.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c","description":"Seen in \"FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications\" (Palo Alto Unit 42). Context: fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c The task_test.json configuration file only has a function c","pattern":"[file:hashes.'SHA-256' = 'a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c']","pattern_type":"stix","valid_from":"2026-08-19T12:04:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/frostygoop-malware-analysis/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--72c276a6-ed4c-4f35-ad93-5060d561291e","created":"2026-08-19T12:03:38.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d","description":"Seen in \"TuxBot v3: Inside an IoT Botnet Framework With LLM\" (Palo Alto Unit 42). Context: 6 The first TuxBot sample appears on VirusTotal SHA256 hash 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d , x86_64 debug build with symbols March 5, 2026 C2 server f","pattern":"[file:hashes.'SHA-256' = '71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d']","pattern_type":"stix","valid_from":"2026-08-19T12:03:38.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--97899a23-e4ca-4f4c-9fd9-aea8b7a20ec4","created":"2026-08-18T04:46:34.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc","description":"Seen in \"Home & Small Office Wireless Routers Exploited to Attack Gaming Servers\" (Palo Alto Unit 42). Context: l JenX sample MD5: fb93601f8d4e0228276edff1c6fe635d SHA256: 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc Updated JenX Sample MD5: f1c099d65bf94e009f5e65238caac468 S","pattern":"[file:hashes.'SHA-256' = '04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc']","pattern_type":"stix","valid_from":"2026-08-18T04:46:34.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-exploited-to-attack-gaming-servers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--556589a6-9b81-4081-950a-927fd678d220","created":"2026-08-18T04:46:34.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07","description":"Seen in \"Home & Small Office Wireless Routers Exploited to Attack Gaming Servers\" (Palo Alto Unit 42). Context: eam uncovered an updated variant of Gafgyt malware (SHA256: 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07 ) derived from JenX variant, and after analyzing the sample","pattern":"[file:hashes.'SHA-256' = '676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07']","pattern_type":"stix","valid_from":"2026-08-18T04:46:34.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-exploited-to-attack-gaming-servers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b90b83c-e11f-490c-8ff9-d04b2b147713","created":"2026-08-17T13:24:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd","description":"Seen in \"Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent\" (Palo Alto Unit 42). Context: 02c2119f62762f78523aa7cbc96ef1 Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4","pattern":"[file:hashes.'SHA-256' = '07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd']","pattern_type":"stix","valid_from":"2026-08-17T13:24:45.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eabadc3-7978-45e2-8379-3680a8eef79f","created":"2026-08-17T13:24:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2","description":"Seen in \"Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent\" (Palo Alto Unit 42). Context: research blog, we are discussing the following file: SHA256 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2 MD5 79ad2084b057847ce2ec2e48fda64073 Compile Date 2017-12-2","pattern":"[file:hashes.'SHA-256' = '290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2']","pattern_type":"stix","valid_from":"2026-08-17T13:24:45.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ee4c92e-fae5-491c-b295-5a2e0bb0a6d3","created":"2026-08-17T13:24:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1","description":"Seen in \"Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent\" (Palo Alto Unit 42). Context: n be seen in the images below: Figure 1 Lure extracted from a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1 Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6","pattern":"[file:hashes.'SHA-256' = 'a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1']","pattern_type":"stix","valid_from":"2026-08-17T13:24:45.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--93e9ec42-6b36-4f66-a8b2-b760a58830e8","created":"2026-08-17T13:24:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a","description":"Seen in \"Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent\" (Palo Alto Unit 42). Context: 67e92b49169c24051ee9de41327ee5e6ac7c2 BADNEWS SHA256 Hashes ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c92","pattern":"[file:hashes.'SHA-256' = 'ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a']","pattern_type":"stix","valid_from":"2026-08-17T13:24:45.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--386142f9-43e6-4055-a08a-1eb4f75de519","created":"2026-08-17T13:24:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571","description":"Seen in \"Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent\" (Palo Alto Unit 42). Context: 6acf5055831cc961a51d3e921f96bd Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571 Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e","pattern":"[file:hashes.'SHA-256' = 'b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571']","pattern_type":"stix","valid_from":"2026-08-17T13:24:45.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--353d9564-a756-4bd0-9034-1af5bc722c74","created":"2026-08-17T13:24:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2","description":"Seen in \"Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent\" (Palo Alto Unit 42). Context: 7e27d2ffa83ca053a87deb7560a571 Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b4","pattern":"[file:hashes.'SHA-256' = 'd486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2']","pattern_type":"stix","valid_from":"2026-08-17T13:24:45.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e0fd9ab-b21b-403c-a9c7-f315c53278a5","created":"2026-08-17T13:24:45.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4","description":"Seen in \"Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent\" (Palo Alto Unit 42). Context: a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4 The payload from each of the malicious documents is an upda","pattern":"[file:hashes.'SHA-256' = 'fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4']","pattern_type":"stix","valid_from":"2026-08-17T13:24:45.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0a41f1a-6f5a-40b6-afdc-7a3373f08544","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0517b62233c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: During runtime, the following plugin was identified: SHA256 0517b62233c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7 SHA1 03defdda9397e7536cf39951246483a0339ccd35 MD5 a5164c686","pattern":"[file:hashes.'SHA-256' = '0517b62233c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aece4c94-51ca-4da0-a5b7-d52a961e1707","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: ted to this IP address: SHA256 Description Connection to IP 0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855 Loader C2 facebook-apps.com (resolves to 89.46.222.97) c356","pattern":"[file:hashes.'SHA-256' = '0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--57f6a659-5021-400a-86cd-a6ada28d5086","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: For the analysis below, we used the following file: SHA256 119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0 SHA1 25ba920cb440b4a1c127c8eb0fb23ee783c9e01a MD5 6fa5bceda","pattern":"[file:hashes.'SHA-256' = '119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea4e1c42-da54-47aa-945c-94cb3bcdeba0","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: o 2 / RU SYSTEM Cluster B Case 2: Delivery via HTA Loader - 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458 In this case the attackers sent an HTML Application file (.","pattern":"[file:hashes.'SHA-256' = '1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c50908a-e492-49f2-8e1c-a281ad0d411c","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: ,helloworld2,sqmAddTostream,DllEntryPoint microsoftfuckedup 6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31 The following actions are performed with the additional fun","pattern":"[file:hashes.'SHA-256' = '6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a440bc8-0971-4b1d-b64a-cf28ffb15926","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: w. Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483 In our research we found at least one attack against a comp","pattern":"[file:hashes.'SHA-256' = 'a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b43396e2-5857-4500-a088-325bd7272942","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: or that sample. The retrieved plugin was as follows: SHA256 b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78 SHA1 ac3f20ddc2567af0b050c672ecd59dddab1fe55e MD5 7c65565dc","pattern":"[file:hashes.'SHA-256' = 'b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f8be572-a25d-49a1-b036-a4ef5a93da8a","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: es have additional unique differences: Hash Functions Mutex bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e helloworld helloworld1,helloworld2,sqmAddTostream,DllEntryP","pattern":"[file:hashes.'SHA-256' = 'bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbc2c0fb-f08f-452e-8ffb-0cb7c2c7fffd","created":"2026-08-17T13:24:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d","description":"Seen in \"RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families\" (Palo Alto Unit 42). Context: d855 Loader C2 facebook-apps.com (resolves to 89.46.222.97) c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d PLAINTEE Hosted on 89.46.222.97 Digging in further, the mal","pattern":"[file:hashes.'SHA-256' = 'c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d']","pattern_type":"stix","valid_from":"2026-08-17T13:24:28.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c20aa487-1b40-49c5-adea-72318c757bca","created":"2026-08-17T13:23:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4","description":"Seen in \"Upatre Continued to Evolve with new Anti\" (Palo Alto Unit 42). Context: omise associated with this analysis include: Upatre SHA256: 8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4 Cthonic SHA256: 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01","pattern":"[file:hashes.'SHA-256' = '8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4']","pattern_type":"stix","valid_from":"2026-08-17T13:23:28.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-upatre-continues-evolve-new-anti-analysis-techniques/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b829740-1495-43ad-8103-a665098e881c","created":"2026-08-17T13:23:28.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83","description":"Seen in \"Upatre Continued to Evolve with new Anti\" (Palo Alto Unit 42). Context: ample configured with the same dot-bit domains. The sample, 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83, was compiled six days after our Upatre sample and delivere","pattern":"[file:hashes.'SHA-256' = '94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83']","pattern_type":"stix","valid_from":"2026-08-17T13:23:28.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/unit42-upatre-continues-evolve-new-anti-analysis-techniques/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9486b085-c7e1-4056-8a42-37299b236218","created":"2026-08-17T13:22:21.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0","description":"Seen in \"Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan\" (Palo Alto Unit 42). Context: d0cf85 SHA1 89a7861acb7983ad712ae9206131c96454a1b3d8 SHA256 0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0 Compile Timestamp 2019-01-07 07:13:47 UTC PDB String c:\\Use","pattern":"[file:hashes.'SHA-256' = '0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0']","pattern_type":"stix","valid_from":"2026-08-17T13:22:21.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d883a6b6-7954-4f82-89cb-d339529da576","created":"2026-08-17T13:22:21.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57","description":"Seen in \"Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan\" (Palo Alto Unit 42). Context: 83bae4 SHA1 d2c161ce52240b61d632607a2262890327d82502 SHA256 ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57 Compile Timestamp 2018-12-06 11:14:45 UTC Table 1 ArtraDown","pattern":"[file:hashes.'SHA-256' = 'ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57']","pattern_type":"stix","valid_from":"2026-08-17T13:22:21.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a5ad350-bea1-4de2-9b17-b7e57c65228c","created":"2026-08-17T13:22:21.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22","description":"Seen in \"Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan\" (Palo Alto Unit 42). Context: 662a59 SHA1 177837d0fa5bfd274abe79d80a01cfe2374b4cd9 SHA256 f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22 Compile Timestamp 2018-07-30 09:18:37 UTC PDB String d:\\C++","pattern":"[file:hashes.'SHA-256' = 'f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22']","pattern_type":"stix","valid_from":"2026-08-17T13:22:21.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce7e6c5d-ce8e-4131-8d8b-fb9cc0450839","created":"2026-08-17T13:22:04.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff","description":"Seen in \"New Python-Based Payload MechaFlounder Used by Chafer\" (Palo Alto Unit 42). Context: [.]com/update.php?req=<redacted>&m=d This payload, (SHA256: 0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff), which we are tracking as MechaFlounder, was developed in","pattern":"[file:hashes.'SHA-256' = '0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff']","pattern_type":"stix","valid_from":"2026-08-17T13:22:04.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d54b1d8a-3735-4e99-b34a-996f765a5ec7","created":"2026-08-17T13:22:04.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1","description":"Seen in \"New Python-Based Payload MechaFlounder Used by Chafer\" (Palo Alto Unit 42). Context: hows a VBScript run by an OilRig delivery document (SHA256: 1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1) on the left compared to a Chafer AutoIT script (SHA256: 33","pattern":"[file:hashes.'SHA-256' = '1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1']","pattern_type":"stix","valid_from":"2026-08-17T13:22:04.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6b4285a-a25e-41b9-9bf7-067c4e4cce4d","created":"2026-08-17T13:22:04.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 332fab21cb0f2f50774fccf94fc7ae905a21b37fe66010dcef6b71c140bb7fa1","description":"Seen in \"New Python-Based Payload MechaFlounder Used by Chafer\" (Palo Alto Unit 42). Context: e1) on the left compared to a Chafer AutoIT script (SHA256: 332fab21cb0f2f50774fccf94fc7ae905a21b37fe66010dcef6b71c140bb7fa1) on the right, which have colored boxes surrounding code ov","pattern":"[file:hashes.'SHA-256' = '332fab21cb0f2f50774fccf94fc7ae905a21b37fe66010dcef6b71c140bb7fa1']","pattern_type":"stix","valid_from":"2026-08-17T13:22:04.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d6bd68a-6635-420c-b5b4-de597574418b","created":"2026-08-17T13:21:46.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f","description":"Seen in \"Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign\" (Palo Alto Unit 42). Context: ooter of Activity.doc file is actually an RTF file (SHA256: 5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f ) that loads an embedded Excel document with a heavily obfu","pattern":"[file:hashes.'SHA-256' = '5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f']","pattern_type":"stix","valid_from":"2026-08-17T13:21:46.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f28a1e4-4abc-4a20-806a-d2a3163cf9f6","created":"2026-08-17T13:21:46.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946","description":"Seen in \"Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign\" (Palo Alto Unit 42). Context: document attached with the filename “Activity.doc” (SHA256: d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946 ) that attempted to load a remote OLE document via Template","pattern":"[file:hashes.'SHA-256' = 'd7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946']","pattern_type":"stix","valid_from":"2026-08-17T13:21:46.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a09dbff3-caec-4392-b1bc-62541ce3ffb9","created":"2026-08-17T13:21:29.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 892d5e8e763073648dfebcfd4c89526989d909d6189826a974f17e2311de8bc4","description":"Seen in \"xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations\" (Palo Alto Unit 42). Context: soka\\\\Hisoka\\\\obj\\\\Debug\\\\inetinfo.sys.pdb The file SHA256: 892d5e8e763073648dfebcfd4c89526989d909d6189826a974f17e2311de8bc4 was used in reference to the below analysis on Hisoka v0.8.","pattern":"[file:hashes.'SHA-256' = '892d5e8e763073648dfebcfd4c89526989d909d6189826a974f17e2311de8bc4']","pattern_type":"stix","valid_from":"2026-08-17T13:21:29.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/xhunt-campaign-attacks-on-kuwait-shipping-and-transportation-organizations/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--07319147-2f1b-4e05-86b2-ab54190249de","created":"2026-08-17T13:19:12.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: eccc65711cbd154f680e8c8ef343d53f29e4a6237510abd4ad1eab5742b035b3","description":"Seen in \"xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection\" (Palo Alto Unit 42). Context: HY200 DNS Tunneling Protocol We analyzed the file ( SHA256: eccc65711cbd154f680e8c8ef343d53f29e4a6237510abd4ad1eab5742b035b3) in order to understand the capabilities of the payload and","pattern":"[file:hashes.'SHA-256' = 'eccc65711cbd154f680e8c8ef343d53f29e4a6237510abd4ad1eab5742b035b3']","pattern_type":"stix","valid_from":"2026-08-17T13:19:12.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/more-xhunt-new-powershell-backdoor-blocked-through-dns-tunnel-detection/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9a7fd49-69f1-4e76-973d-bc95e8ce6a6c","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 24e3fa3fb1df9bd70071e5b957d180cd51bcf10bab690fa7db7425ca6652c47c","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: yload SHA256 11/7/19 clementeolmos[.]com/supp.php erfd1.exe 24e3fa3fb1df9bd70071e5b957d180cd51bcf10bab690fa7db7425ca6652c47c e9fd22631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f157","pattern":"[file:hashes.'SHA-256' = '24e3fa3fb1df9bd70071e5b957d180cd51bcf10bab690fa7db7425ca6652c47c']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8427f0b0-d3ca-4def-a1bc-53f8c3ec1d67","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 7d6ff8baebedba414c9f15060f0a8470965369cbc1088e9f21e2b5289b42a747","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: rt.exe lindaspryinteriordesign[.]com/supp.php nfdusdarm.exe 7d6ff8baebedba414c9f15060f0a8470965369cbc1088e9f21e2b5289b42a747 Table 2. Trickbot Payload Download Locations The two payloa","pattern":"[file:hashes.'SHA-256' = '7d6ff8baebedba414c9f15060f0a8470965369cbc1088e9f21e2b5289b42a747']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b95cdf0-c913-4377-af6e-19ec61096793","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b3d2e7158620ece90fbc062892db55bf564c6154eb85facab57a459e3bd1156f","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: 59fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe71a64 b3d2e7158620ece90fbc062892db55bf564c6154eb85facab57a459e3bd1156f Table 3. Additional Trickbot payloads observed Conclusion B","pattern":"[file:hashes.'SHA-256' = 'b3d2e7158620ece90fbc062892db55bf564c6154eb85facab57a459e3bd1156f']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--235cc216-eab9-4815-90c7-a22bf1e55fb4","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: b8c2329906b4712caa0f8ca7941553b3ed6da1cd1f5cb70f1409df5bc1f0ee4a","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: ing Theme File Name SHA256 Annual bonus StatementReport.exe b8c2329906b4712caa0f8ca7941553b3ed6da1cd1f5cb70f1409df5bc1f0ee4a Payroll Preview_Report.exe f8aaf313cc213258c6976cd55c8c0d04","pattern":"[file:hashes.'SHA-256' = 'b8c2329906b4712caa0f8ca7941553b3ed6da1cd1f5cb70f1409df5bc1f0ee4a']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b556fe1a-9cbd-4dd0-8b4c-834cb0432fff","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d1e0902fd1e8b3951e2aec057a938db9eebe4a0efa573343d89703482cafb2d8","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: HA256 StatementReport.exe savute[.]in/supp.php nfdsus12.exe d1e0902fd1e8b3951e2aec057a938db9eebe4a0efa573343d89703482cafb2d8 Preview_Report.exe lindaspryinteriordesign[.]com/supp.php n","pattern":"[file:hashes.'SHA-256' = 'd1e0902fd1e8b3951e2aec057a938db9eebe4a0efa573343d89703482cafb2d8']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7839c10f-1c10-43db-b58d-ab5cd8d9139f","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: d7687e1d98484b093e8da7fb666b2d644197fc3ea22b3931a6150c259479b0c6","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: 2631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f1574aad0 d7687e1d98484b093e8da7fb666b2d644197fc3ea22b3931a6150c259479b0c6 dc8f259fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe","pattern":"[file:hashes.'SHA-256' = 'd7687e1d98484b093e8da7fb666b2d644197fc3ea22b3931a6150c259479b0c6']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f03090d-ba8c-4a56-998d-abc236e29feb","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: dc8f259fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe71a64","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: 11/19/19 maisonmarielouise[.]org/supp.php SetupDesktop.exe dc8f259fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe71a64 b3d2e7158620ece90fbc062892db55bf564c6154eb85facab57a459e3bd","pattern":"[file:hashes.'SHA-256' = 'dc8f259fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe71a64']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--da6abf98-2cd2-47c1-a2c3-b070c4e17abc","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e9fd22631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f1574aad0","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: a3fb1df9bd70071e5b957d180cd51bcf10bab690fa7db7425ca6652c47c e9fd22631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f1574aad0 d7687e1d98484b093e8da7fb666b2d644197fc3ea22b3931a6150c25947","pattern":"[file:hashes.'SHA-256' = 'e9fd22631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f1574aad0']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--26606b1a-dc5b-41e1-a476-b583c77f0921","created":"2026-08-17T13:18:48.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: f8aaf313cc213258c6976cd55c8c0d048f61b0f3b196d768fbf51779786b6ac6","description":"Seen in \"TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks\" (Palo Alto Unit 42). Context: ed6da1cd1f5cb70f1409df5bc1f0ee4a Payroll Preview_Report.exe f8aaf313cc213258c6976cd55c8c0d048f61b0f3b196d768fbf51779786b6ac6 Table 1. Trickbot downloader files Both of these downloader","pattern":"[file:hashes.'SHA-256' = 'f8aaf313cc213258c6976cd55c8c0d048f61b0f3b196d768fbf51779786b6ac6']","pattern_type":"stix","valid_from":"2026-08-17T13:18:48.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6a2a3da-a576-4cbc-92d5-11885b39429d","created":"2026-08-17T13:18:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 41d27d53c5d41003bc9913476a3afd3961b561b120ee8bfde327a5f0d22a040a","description":"Seen in \"Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT\" (Palo Alto Unit 42). Context: be downloaded when using msiexec. The MSI payload (SHA256: 41D27D53C5D41003BC9913476A3AFD3961B561B120EE8BFDE327A5F0D22A040A ) was built using an unregistered version from www.exemsi[.","pattern":"[file:hashes.'SHA-256' = '41d27d53c5d41003bc9913476a3afd3961b561b120ee8bfde327a5f0d22a040a']","pattern_type":"stix","valid_from":"2026-08-17T13:18:13.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8885121f-f660-4071-a7ac-8c802fb1eff1","created":"2026-08-17T13:18:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: 68ca2458e0db9739258ce9e22aadd2423002b2cc779033d78d6abec1db534ac2","description":"Seen in \"Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT\" (Palo Alto Unit 42). Context: e macro code below. The hash for this macro code is SHA256: 68ca2458e0db9739258ce9e22aadd2423002b2cc779033d78d6abec1db534ac2 If the user enters an incorrect password, they are presente","pattern":"[file:hashes.'SHA-256' = '68ca2458e0db9739258ce9e22aadd2423002b2cc779033d78d6abec1db534ac2']","pattern_type":"stix","valid_from":"2026-08-17T13:18:13.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--198e0ab1-4473-4d7e-8dd4-c1494ce10d43","created":"2026-08-17T13:18:13.000Z","modified":"2026-09-16T13:18:01.793Z","created_by_ref":"identity--ed53f8e0-4a6d-493b-9ed6-50e3562891cc","name":"sha256: e9440a5d2dfe2453ae5b69a9c096f8d4cf9e059d469c5de67380d76e02dd6975","description":"Seen in \"Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT\" (Palo Alto Unit 42). Context: able macros. The document used for this analysis is SHA256: E9440A5D2DFE2453AE5B69A9C096F8D4CF9E059D469C5DE67380D76E02DD6975 Figure 4. Delivery document disguised as NortonLifeLock. To","pattern":"[file:hashes.'SHA-256' = 'e9440a5d2dfe2453ae5b69a9c096f8d4cf9e059d469c5de67380d76e02dd6975']","pattern_type":"stix","valid_from":"2026-08-17T13:18:13.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/cortex-xdr-detects-netsupport-manager-rat-campaign/"}]}]}