{"type":"bundle","id":"bundle--867672d2-7960-438a-8b73-09c73b73be62","objects":[{"type":"identity","spec_version":"2.1","id":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","created":"2026-09-15T22:16:21.587Z","modified":"2026-09-15T22:16:21.587Z","name":"ZeroHour","identity_class":"system","description":"Indicators auto-extracted from public security reporting. Verify before use."},{"type":"indicator","spec_version":"2.1","id":"indicator--8da2de9e-6b64-47e4-befd-06b3f3ad7749","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: cb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975","pattern":"[file:hashes.'SHA-256' = '06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9132dd9-1ac2-4a2c-8a9c-48a07e6266af","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: b7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c287","pattern":"[file:hashes.'SHA-256' = '131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--52e44aa9-6b61-43ab-af5f-b2a2af989e40","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 3c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd","pattern":"[file:hashes.'SHA-256' = '18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d22eebc3-b150-4a48-8777-d7058b554ac1","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 9ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e8","pattern":"[file:hashes.'SHA-256' = '249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e5a2168-63d5-45e0-b908-9ee21f5f485c","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 2365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3","pattern":"[file:hashes.'SHA-256' = '279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--298ca938-a94c-4aa7-af6c-5717a2a96682","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24 InstallFix MP3/HTA, InstallFix /cl and recovered InstallFix","pattern":"[file:hashes.'SHA-256' = '3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2b31791-bd36-4533-a1b0-9635406fb424","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 83129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92","pattern":"[file:hashes.'SHA-256' = '480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--27e6de7c-6203-4def-8a5c-8d87428b9323","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: ake Ledger, Trezor and Exodus application artifacts SHA-256 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c89179","pattern":"[file:hashes.'SHA-256' = '5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9ea73f6-fd45-475a-96db-ad5afb4102a6","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739","pattern":"[file:hashes.'SHA-256' = '6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--50b4f15b-aa59-4461-aaec-47b92ea41e3d","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 41ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494","pattern":"[file:hashes.'SHA-256' = '93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--de2d56c0-9f3b-462a-9b76-eb4aa73dbb32","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96 Houston, Pressureulcerlawyer, Lalandscapelighting, Aidevmas","pattern":"[file:hashes.'SHA-256' = '9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--266000b4-5e2c-42e7-8ff5-556ba9d9b014","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5","pattern":"[file:hashes.'SHA-256' = 'a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--34a73ead-f247-487a-abd1-89c231a9ffdc","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0","pattern":"[file:hashes.'SHA-256' = 'd1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--751e4cb4-fb94-465f-837b-4450e3bf597a","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c","pattern":"[file:hashes.'SHA-256' = 'd4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5449f92-b640-41ad-a633-0bdfd21eda7f","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c","pattern":"[file:hashes.'SHA-256' = 'd4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6d872dc-357d-43ca-8a56-282c772ec882","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e5","pattern":"[file:hashes.'SHA-256' = 'd95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b90bf842-2a94-41c6-ae16-c10a2151410e","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c","pattern":"[file:hashes.'SHA-256' = 'e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2c9d4c1-2dd2-4673-b946-3b4c879577db","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: , InstallFix /cl and recovered InstallFix artifacts SHA-256 ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1a","pattern":"[file:hashes.'SHA-256' = 'ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2794a63-65ef-49eb-9fe8-19298ac154bd","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 1301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb Fake Ledger, Trezor and Exodus application artifacts SHA-25","pattern":"[file:hashes.'SHA-256' = 'ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--130d234f-4569-499b-9322-09155a47257d","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: ec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b","pattern":"[file:hashes.'SHA-256' = 'ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9e65917-4842-4b73-b41e-02c0f5b916cf","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: Selectors for getData() , balanceOf() and setData() SHA-256 eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf","pattern":"[file:hashes.'SHA-256' = 'eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--30f18e7e-5741-40ae-bd3c-dbbe4ce75ea7","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: 63b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287","pattern":"[file:hashes.'SHA-256' = 'f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1967f7d6-a62f-4cb2-aca0-20b33573c99a","created":"2026-09-15T06:56:40.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e","description":"Seen in \"Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads\" (Cyber Security News). Context: b41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f1","pattern":"[file:hashes.'SHA-256' = 'f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e']","pattern_type":"stix","valid_from":"2026-09-15T06:56:40.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-hijack-hbo-max/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a3ddd56-a9bf-4865-a1b2-0bfa88952953","created":"2026-09-14T13:50:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc","description":"Seen in \"Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users\" (Cyber Security News). Context: ple.com Twitch Enhanced Viewer Firefox Add-ons ID; SHA-256: 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc Note: IP addresses and domains are intentionally defanged (","pattern":"[file:hashes.'SHA-256' = '141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc']","pattern_type":"stix","valid_from":"2026-09-14T13:50:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/malicious-twitch-extension/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b07ac0e-94fa-4b1e-b7e3-27085b33092d","created":"2026-09-14T13:50:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8","description":"Seen in \"Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users\" (Cyber Security News). Context: ed Viewer | JeetBot Chrome Web Store extension ID; SHA-256: e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8 Firefox extension twitchenhancedviewer@example.com Twitch E","pattern":"[file:hashes.'SHA-256' = 'e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8']","pattern_type":"stix","valid_from":"2026-09-14T13:50:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/malicious-twitch-extension/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae7f0918-86a9-4e55-9759-61343036847b","created":"2026-09-14T13:01:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63","description":"Seen in \"One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users\" (Cyber Security News). Context: RAYRABBIT command-and-control domain using port 443 SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 Trojanized DLL loader, originally identified as 7zp.dll wit","pattern":"[file:hashes.'SHA-256' = '29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63']","pattern_type":"stix","valid_from":"2026-09-14T13:01:36.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/one-click-on-a-malicious-link/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f2c8598-8997-4625-8d6d-830472d55a07","created":"2026-09-14T13:01:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e","description":"Seen in \"One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users\" (Cyber Security News). Context: ly identified as 7zp.dll with internal name boy.dll SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e Encrypted payload blob identified as p SHA-256 D7a3c7eb94ed","pattern":"[file:hashes.'SHA-256' = '749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e']","pattern_type":"stix","valid_from":"2026-09-14T13:01:36.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/one-click-on-a-malicious-link/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea9d0a05-25b0-4809-ad3e-728a8c665dae","created":"2026-09-14T13:01:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a","description":"Seen in \"One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users\" (Cyber Security News). Context: 98662e02422e Encrypted payload blob identified as p SHA-256 D7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor with internal name core.dll File name 7","pattern":"[file:hashes.'SHA-256' = 'd7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a']","pattern_type":"stix","valid_from":"2026-09-14T13:01:36.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/one-click-on-a-malicious-link/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a89214a-9812-4365-a0ef-63a93764be8e","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 1b17917e2e183a4bd9cbcb2ed77e Malicious PDF lure PDF SHA-256 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a Malicious PDF lure Email SHA-256 debe871710268e7bb770b72c67","pattern":"[file:hashes.'SHA-256' = '0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cdf8d8d-2c25-44f2-bd04-ea4d4ec87751","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 659880e1a8a7b0a2dd851dc5e7a3 Malicious PDF lure PDF SHA-256 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5 Malicious PDF lure PDF SHA-256 c521b3a189b0089a2558aa4e42bd","pattern":"[file:hashes.'SHA-256' = '0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e3c046b-877a-4bc0-94e5-0b41851fdc6c","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 4a2145348b953b1d06e2eaf0bf2c Malicious PDF lure PDF SHA-256 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed Malicious PDF lure PDF SHA-256 62ef39ec29966d71c8254f68bd5e","pattern":"[file:hashes.'SHA-256' = '1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e60eb89-060a-4b13-9c1a-c4c8aa7a3581","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 042d76c12dbafdcc0766861827c5 Malicious PDF lure PDF SHA-256 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491 Malicious PDF lure PDF SHA-256 ea8af591fe2d605c82bb7831d2eb","pattern":"[file:hashes.'SHA-256' = '1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5165b8b6-2174-4def-8ff8-d6629825e0b1","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 64f8db457bafafb97a011da59e73 Malicious PDF lure PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd Malicious PDF lure PDF SHA-256 bf92a287a3d79afb73a3f2d38877","pattern":"[file:hashes.'SHA-256' = '40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--77dd7ca2-b82b-447d-9135-0ff442382ed7","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 89eb6b87bb0 2f0bd59d565 Phishing email artifact HTA SHA-256 4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044 HTA downloader HTA SHA-256 85767416f8d1e73833ccaa193263d119","pattern":"[file:hashes.'SHA-256' = '4302586202234cdf1ca058fd3c62be0050c8155ed113f3f62337d756e6915044']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa7e65b2-f9ca-44d7-ba0f-fea8d59f41b7","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 246d3d50110c6b0c248919ad796c6fd4 HTA downloader HTA SHA-256 4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697 HTA downloader HTA SHA-256 92a1428e125f33de012c7f52fb0827be","pattern":"[file:hashes.'SHA-256' = '4540c3af3b1d8c52256f4580dd4d002fadb8c5ff4e32e6a41fdf508455c5b697']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5d564ac-0597-4d99-8918-211266510105","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: ca6e1b70fe30ba3752b881574365 Malicious PDF lure PDF SHA-256 47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95 Malicious PDF lure PDF SHA-256 d13ad6fc5fda54e65f1214e554a5","pattern":"[file:hashes.'SHA-256' = '47d321c1a232e5cdd1e39a06dadbd79114dc1a2f0f8eac289e6b653a5d126f95']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ae45fd9-90a8-47e7-8f43-a21219755aaa","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 3b5c42dd2a33b5a6520159b41c43b093 HTA downloader HTA SHA-256 51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c HTA downloader HTA SHA-256 5b3c2442831d4844ea6b86942f1a0ba2","pattern":"[file:hashes.'SHA-256' = '51503ce1373c7fa72a1da5c5c4b30f88c8224686669ba4b64196591414fdc64c']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--736a14ae-3315-4d75-80f7-cbfe9feeb497","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: f537a02949315eb768c88906b0c65add HTA downloader HTA SHA-256 5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e HTA downloader HTA SHA-256 8092b9de455463296898fcaf8c9955d1","pattern":"[file:hashes.'SHA-256' = '5a76669ec410d0b3e21112a4a6fd3207976b299ee27c5fc3d42f2673170ab95e']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7bd0fde-53bb-4010-aa30-1ac99d535088","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: c8224686669ba4b64196591414fdc64c HTA downloader HTA SHA-256 5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02 HTA downloader HTA SHA-256 71dea06c2271a46fc2fd6092e2ba0c2f","pattern":"[file:hashes.'SHA-256' = '5b3c2442831d4844ea6b86942f1a0ba27170018382cbc362343db63717d0ff02']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ede5f2da-ed3a-4cf4-91e3-951bb4161886","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: badab12bcdcb47f3dad8bc6fa8ed Malicious PDF lure PDF SHA-256 62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5 Malicious PDF lure PDF SHA-256 1f1a89bef73e4866a198a08e750f","pattern":"[file:hashes.'SHA-256' = '62ef39ec29966d71c8254f68bd5e320cf24a042d76c12dbafdcc0766861827c5']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a95d51d-0483-449c-abd5-7d6fc189507a","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 02b1b25b78e5f3707e81bad5054cf4e8 HTA downloader HTA SHA-256 6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093 HTA downloader HTA SHA-256 51503ce1373c7fa72a1da5c5c4b30f88","pattern":"[file:hashes.'SHA-256' = '6547736c31dabb5bef2a290b32a72bf63b5c42dd2a33b5a6520159b41c43b093']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--de0c7d90-a2c2-4828-be81-4396e0c0ed57","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: compromise (IoCs):- Type Indicator Description PDF SHA-256 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 Malicious PDF lure PDF SHA-256 40d253480f752805e58c21266e40","pattern":"[file:hashes.'SHA-256' = '6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--319cb7b8-4ff6-465e-ad62-bf5b8efcbc2c","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: aff294f5250c2eed406765032cb68756 HTA downloader HTA SHA-256 6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4 HTA downloader HTA SHA-256 4540c3af3b1d8c52256f4580dd4d002f","pattern":"[file:hashes.'SHA-256' = '6e6bd2f7566ffa52d52fa9d5f048bbb9246d3d50110c6b0c248919ad796c6fd4']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e574f501-54bf-4240-aada-ac24aa448a59","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: ff91c829d87f566bee453d715280 Malicious PDF lure PDF SHA-256 711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859 Malicious PDF lure PDF SHA-256 d910e08a11a4f6f764e7495f4602","pattern":"[file:hashes.'SHA-256' = '711c0aa8cde078aa349fb329e3e44e4272ea66a5e651ad8a64893c76a725c859']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa5c5ca8-d208-4cc4-bf5d-06a93b011077","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 7170018382cbc362343db63717d0ff02 HTA downloader HTA SHA-256 71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b HTA downloader Domain 128[.]200[.]178[.]68[.]host[.]secures","pattern":"[file:hashes.'SHA-256' = '71dea06c2271a46fc2fd6092e2ba0c2f5a2cf5ca8f955ee3375e3ca66a5dc52b']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--25a20873-3aec-4578-8ba7-f889d39dd32e","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 5d7407ba AutoIt loader component Casbaneiro payload SHA-256 7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8 Casbaneiro payload Cryptocurrency address 0xb4c12078448fdef","pattern":"[file:hashes.'SHA-256' = '7de637539159dc17ceedb0aae783930ee68639b6d8036ef8147027c5ebca3fc8']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--52d26021-f8bb-4b54-8594-d193f8a615e2","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 2abf7f72ef093292c86c1e9e7c2be456 HTA downloader HTA SHA-256 7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8 HTA downloader HTA SHA-256 6547736c31dabb5bef2a290b32a72bf6","pattern":"[file:hashes.'SHA-256' = '7e04e86c07213fed7bebccd9953818b102b1b25b78e5f3707e81bad5054cf4e8']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2296a35a-80fb-4405-a5bb-a777bd0e77a3","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 976b299ee27c5fc3d42f2673170ab95e HTA downloader HTA SHA-256 8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33 HTA downloader HTA SHA-256 99fcabf7c996d6ec077ccd745a158a3a","pattern":"[file:hashes.'SHA-256' = '8092b9de455463296898fcaf8c9955d1c00dae6812c03bba019edf9c059ece33']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b538e8c1-1e87-4775-8a56-f3711231cc41","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 50c8155ed113f3f62337d756e6915044 HTA downloader HTA SHA-256 85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f HTA downloader HTA SHA-256 f1aa14ebfd2da477edba94b34f09f775","pattern":"[file:hashes.'SHA-256' = '85767416f8d1e73833ccaa193263d1198857308b3a1185e6f4ebc4164db8584f']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1d33e89-babc-4075-b3d7-32924866dea7","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 395403d6a3df9d8da179f3cd5faf81b1 HTA downloader HTA SHA-256 875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b HTA downloader HTA SHA-256 bd724bbb27f9a71fd44f1c334b003541","pattern":"[file:hashes.'SHA-256' = '875e8d4137e1016b4be869e36e00a9414e89902fd5592a2fb881ebb0e4bd2f8b']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7be415c2-b292-4aaf-a808-021fd46f7881","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: adb8c5ff4e32e6a41fdf508455c5b697 HTA downloader HTA SHA-256 92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c HTA downloader HTA SHA-256 e57409c5e1f8287900c1c3b3e8c099ce","pattern":"[file:hashes.'SHA-256' = '92a1428e125f33de012c7f52fb0827be3d7e90e38a0e38083181f8c3312adc9c']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--81ea0678-4f30-4d36-991f-d70982197e96","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 9f4a7d6ac2e0385472298f384fc8 Malicious PDF lure PDF SHA-256 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 Malicious PDF lure PDF SHA-256 711c0aa8cde078aa349fb329e3e4","pattern":"[file:hashes.'SHA-256' = '943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--50c8a09b-e90b-40af-bbad-a8cceb7cac74","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: c00dae6812c03bba019edf9c059ece33 HTA downloader HTA SHA-256 99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1 HTA downloader HTA SHA-256 875e8d4137e1016b4be869e36e00a941","pattern":"[file:hashes.'SHA-256' = '99fcabf7c996d6ec077ccd745a158a3a395403d6a3df9d8da179f3cd5faf81b1']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9aead7f2-4041-4de6-8d12-1286fe3bd185","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 761071655fa585b64eed3bd78fc28e01 HTA downloader HTA SHA-256 a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456 HTA downloader HTA SHA-256 7e04e86c07213fed7bebccd9953818b1","pattern":"[file:hashes.'SHA-256' = 'a42daeca71a6bdc79fd66b8b6ee413562abf7f72ef093292c86c1e9e7c2be456']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dd6df17-fd7f-4e3f-8ed4-c72ccc58f8e4","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 4e89902fd5592a2fb881ebb0e4bd2f8b HTA downloader HTA SHA-256 bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01 HTA downloader HTA SHA-256 a42daeca71a6bdc79fd66b8b6ee41356","pattern":"[file:hashes.'SHA-256' = 'bd724bbb27f9a71fd44f1c334b003541761071655fa585b64eed3bd78fc28e01']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb80a175-49b9-48ab-b257-e645bc28f582","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 96feea0d355732af5bea459db1dd Malicious PDF lure PDF SHA-256 bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 Malicious PDF lure PDF SHA-256 943d63ace373ee50d074daf84d35","pattern":"[file:hashes.'SHA-256' = 'bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb400e93-8495-4018-a17d-674441f0b71c","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 485688b5958d82fcb072a837e27e246b HTA downloader HTA SHA-256 c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756 HTA downloader HTA SHA-256 6e6bd2f7566ffa52d52fa9d5f048bbb9","pattern":"[file:hashes.'SHA-256' = 'c477bdfae91e3df9be29e9eeba785467aff294f5250c2eed406765032cb68756']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a93a489-42dc-4581-a6b0-252114e082e1","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: fae0b57d708aebd77d99667616d5 Malicious PDF lure PDF SHA-256 c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e Malicious PDF lure PDF SHA-256 0849a6b87fbef25089ad0be746f8","pattern":"[file:hashes.'SHA-256' = 'c521b3a189b0089a2558aa4e42bd9fb5558e1b17917e2e183a4bd9cbcb2ed77e']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4022352d-4d00-440b-983c-f71d5308bc45","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 7b3ce6db57566ed7bd0e92d03d85 Malicious PDF lure PDF SHA-256 d04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c Malicious PDF lure PDF SHA-256 1b4d5c95f4fc037ca3c359cea5ca","pattern":"[file:hashes.'SHA-256' = 'd04f68079ca90c65223a907f23fae5d068904a2145348b953b1d06e2eaf0bf2c']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f080e10-e049-49d9-85c9-71681afaa201","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 1a2f0f8eac289e6b653a5d126f95 Malicious PDF lure PDF SHA-256 d13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85 Malicious PDF lure PDF SHA-256 d04f68079ca90c65223a907f23fa","pattern":"[file:hashes.'SHA-256' = 'd13ad6fc5fda54e65f1214e554a5123126ac7b3ce6db57566ed7bd0e92d03d85']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--31577b5e-58d7-461e-a592-5602313af934","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 66a5e651ad8a64893c76a725c859 Malicious PDF lure PDF SHA-256 d910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365 Malicious PDF lure PDF SHA-256 47d321c1a232e5cdd1e39a06dadb","pattern":"[file:hashes.'SHA-256' = 'd910e08a11a4f6f764e7495f4602a00b6024ca6e1b70fe30ba3752b881574365']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c542d1ec-0471-4675-9b4d-d411c96f0ca2","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 3d7e90e38a0e38083181f8c3312adc9c HTA downloader HTA SHA-256 e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add HTA downloader HTA SHA-256 5a76669ec410d0b3e21112a4a6fd3207","pattern":"[file:hashes.'SHA-256' = 'e57409c5e1f8287900c1c3b3e8c099cef537a02949315eb768c88906b0c65add']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5784f27a-ab2d-4e10-886a-7044d612a87b","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: b82816a8353e9a8a574bfde5f491 Malicious PDF lure PDF SHA-256 ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3 Malicious PDF lure PDF SHA-256 0b4d962eef2d06abfe08a8cd0b15","pattern":"[file:hashes.'SHA-256' = 'ea8af591fe2d605c82bb7831d2ebdfb17cb2659880e1a8a7b0a2dd851dc5e7a3']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1eecf766-098a-466a-8343-7a4ff876b633","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 8857308b3a1185e6f4ebc4164db8584f HTA downloader HTA SHA-256 f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b HTA downloader HTA SHA-256 c477bdfae91e3df9be29e9eeba785467","pattern":"[file:hashes.'SHA-256' = 'f1aa14ebfd2da477edba94b34f09f775485688b5958d82fcb072a837e27e246b']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b755526-6035-49c0-b36d-3ad51a628046","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: b07b25cc7d910 AutoIt loader component AutoIt script SHA-256 f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba AutoIt loader component Casbaneiro payload SHA-256 7de63753","pattern":"[file:hashes.'SHA-256' = 'f76d09cbd455ce18765591b9efa3bde0d31358b6321f7a10fc2e04f65d7407ba']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a93c6060-91f1-4bb5-a1c0-90a72d15a3ed","created":"2026-09-14T08:42:16.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910","description":"Seen in \"Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites\" (Cyber Security News). Context: 99[.]188[.]28 Campaign infrastructure AutoIt script SHA-256 fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910 AutoIt loader component AutoIt script SHA-256 f76d09cbd455c","pattern":"[file:hashes.'SHA-256' = 'fc820eeb054c781693eca78fed1c418f12b27da2c7c7e73281eb07b25cc7d910']","pattern_type":"stix","valid_from":"2026-09-14T08:42:16.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dca440e4-2741-4dda-807f-8f4103482bed","created":"2026-09-14T08:09:26.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63","description":"Seen in \"China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor\" (GBHackers). Context: involving 7-Zip binaries. IOCs Indicator Value SHA-256 hash 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 Associated file 7zp.dll File description Trojanized DLL loa","pattern":"[file:hashes.'SHA-256' = '29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63']","pattern_type":"stix","valid_from":"2026-09-14T08:09:26.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/grayrabbit-backdoor/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c7044e8-661e-49bb-9a00-5b59a61302f2","created":"2026-09-14T08:09:26.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e","description":"Seen in \"China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor\" (GBHackers). Context: on Trojanized DLL loader Internal name boy.dll SHA-256 hash 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e Associated file p File description Encrypted PE loader shel","pattern":"[file:hashes.'SHA-256' = '749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e']","pattern_type":"stix","valid_from":"2026-09-14T08:09:26.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/grayrabbit-backdoor/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ad706d-2d15-445b-adb4-d7a31a4456a1","created":"2026-09-14T08:09:26.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a","description":"Seen in \"China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor\" (GBHackers). Context: File description Encrypted PE loader shellcode SHA-256 hash d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a Associated malware GRAYRABBIT backdoor Internal name core.d","pattern":"[file:hashes.'SHA-256' = 'd7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a']","pattern_type":"stix","valid_from":"2026-09-14T08:09:26.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/grayrabbit-backdoor/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7128d75c-47fa-4dee-b9ae-94a1ae4d0410","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: de3cdf Resource icon shared across ARKTunnel samples SHA256 06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5 Resource icon shared across ARKTunnel samples SHA256 2c6e11","pattern":"[file:hashes.'SHA-256' = '06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3428377-e599-4214-af29-f3d919ed8ee2","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 9ed15ce1a6961 eld0.exe , Insomnia RAT initial loader SHA256 25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5 eld0.tmp unpacked loader stage SHA256 9b0d9cbc0fd4a7bae8b78","pattern":"[file:hashes.'SHA-256' = '25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2a49ff4-a869-49cf-afc2-6e46f7c9f0a0","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 6cdac5 Resource icon shared across ARKTunnel samples SHA256 2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354 eld2.exe , Docro Hijacker branch installer SHA256 553ce594c","pattern":"[file:hashes.'SHA-256' = '2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d419a80-311e-4416-9f7e-bce8b4aa3ffe","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: efff1f2d73 windirstat.tmp unpacked OfferLoader stage SHA256 3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961 eld0.exe , Insomnia RAT initial loader SHA256 25558ea78c4aa","pattern":"[file:hashes.'SHA-256' = '3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--69e79508-ac87-4d2c-95b9-15002625d6fc","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 2c297d354 eld2.exe , Docro Hijacker branch installer SHA256 553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104 eld2.tmp , unpacked Docro Hijacker stage SHA256 fdcc95b7791","pattern":"[file:hashes.'SHA-256' = '553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--36fa98bd-ff4e-4a9d-9c54-7fca94c6d7ff","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: de Python component of the Insomnia RAT dual payload SHA256 62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e aa.js , Node.js component of the Insomnia RAT dual payload","pattern":"[file:hashes.'SHA-256' = '62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cfeb78d-9491-4ccc-8144-09a236ae9476","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: rs of Compromise (IoCs):- Type Indicator Description SHA256 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c Trojanized windirstat.exe OfferLoader installer delivered t","pattern":"[file:hashes.'SHA-256' = '7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2515ec75-e095-43c8-8070-5710630de77e","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 9d144a5801a40e48fd4c5 eld0.tmp unpacked loader stage SHA256 9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69 a.dll , PowerShell downloader for Insomnia RAT stages SHA25","pattern":"[file:hashes.'SHA-256' = '9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cbaacf0-2d82-42d8-9150-1ae70edb3f96","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: , Node.js component of the Insomnia RAT dual payload SHA256 aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1 eld1.exe , ARKTunnel steganography dropper SHA256 e05bc22af","pattern":"[file:hashes.'SHA-256' = 'aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--70b5f647-0fad-4684-9f2b-64ae7bae4af4","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: Trex.zip , archive extracted from the bitmap payload SHA256 b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c wscl.exe , ARKTunnel WebSocket tunneling RAT SHA256 d8d783f","pattern":"[file:hashes.'SHA-256' = 'b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--11249d6d-4d70-46d8-ae8f-51b4a19ca0be","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: .dll , PowerShell downloader for Insomnia RAT stages SHA256 ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e t.ps1 , Insomnia RAT PowerShell loader SHA256 cf184d04ca31f","pattern":"[file:hashes.'SHA-256' = 'ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--de204984-6e2e-43cd-85c2-ce4e2e649fb5","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 0b4d636eb576e t.ps1 , Insomnia RAT PowerShell loader SHA256 cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de Python component of the Insomnia RAT dual payload SHA256 62","pattern":"[file:hashes.'SHA-256' = 'cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f306611-c94e-425c-9dee-24a0ea53074a","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: c87989c wscl.exe , ARKTunnel WebSocket tunneling RAT SHA256 d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf Resource icon shared across ARKTunnel samples SHA256 06e0af","pattern":"[file:hashes.'SHA-256' = 'd8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f87bef9-5ef4-44fe-bbf9-7763ad096588","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: 90b4560f1 eld1.exe , ARKTunnel steganography dropper SHA256 e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d procorTrex.zip , archive extracted from the bitmap payload","pattern":"[file:hashes.'SHA-256' = 'e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb85f4b1-3851-4950-b45e-f875646aaed0","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: fferLoader installer delivered through SEO poisoning SHA256 fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 windirstat.tmp unpacked OfferLoader stage SHA256 3052bd320a","pattern":"[file:hashes.'SHA-256' = 'fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b83a9df1-e0af-403b-8523-388e68fc096e","created":"2026-09-14T08:01:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007","description":"Seen in \"Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker\" (Cyber Security News). Context: c15bab72104 eld2.tmp , unpacked Docro Hijacker stage SHA256 fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007 Adblock.dll , Chrome Secure Preferences bypass DLL File nam","pattern":"[file:hashes.'SHA-256' = 'fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007']","pattern_type":"stix","valid_from":"2026-09-14T08:01:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-abuse-youtube-gaming/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--abdde94b-6027-43e0-9b60-838ae9a094d7","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: 76409f69d445a93910964f8db457bafafb97a011da59e73 PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd Email SHA-256 debe871710268e7bb770b72c6772f2e0b8bd40a22b2ea","pattern":"[file:hashes.'SHA-256' = '40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ff3bb13-d18d-4034-aa60-d1e7b2da5c3c","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: o financial websites. IOCs Indicator type Value PDF SHA-256 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355","pattern":"[file:hashes.'SHA-256' = '6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c14f5f3c-ce62-46a9-8303-8f64c4819c82","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: c21266e40afe99afc96feea0d355732af5bea459db1dd Email SHA-256 debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email SHA-256 eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc6","pattern":"[file:hashes.'SHA-256' = 'debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bfeb7e1-2af8-459f-aaaf-1b02aacf655c","created":"2026-09-14T05:56:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390","description":"Seen in \"Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users\" (GBHackers). Context: 0b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email SHA-256 eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 Domain 128[.]200[.]178[.]68[.]host[.]secureserver[.]net Dom","pattern":"[file:hashes.'SHA-256' = 'eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390']","pattern_type":"stix","valid_from":"2026-09-14T05:56:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/casbaneiro-banking-trojan/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--56681f9f-5b8a-4f94-b472-5560b92e6648","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: 122ea3cbcb99c8a525b0b30ab985bc8e375c7a 3200000_02C37000.exe 15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda Note: IP addresses and domains are intentionally defanged (","pattern":"[file:hashes.'SHA-256' = '15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ee9b0ce-6d34-4ca5-9e82-f0da395f2b3f","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: d5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c 3200000.exe 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a 3200000_02C37000.exe 15700817e517fefcabc0291e350daf3e10d52f","pattern":"[file:hashes.'SHA-256' = '22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--35ca0bff-1be1-4d9d-8f1c-a4a7d1a7fddb","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: 1fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6 kojuyn.ini 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c 3200000.exe 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b","pattern":"[file:hashes.'SHA-256' = '4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec7341a7-a06d-4201-a271-ca6b0b6c4959","created":"2026-09-14T05:24:48.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6","description":"Seen in \"AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process\" (GBHackers). Context: Cs Filename SHA-256 Right-click to open Invoice Details.bat ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6 kojuyn.ini 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c74","pattern":"[file:hashes.'SHA-256' = 'ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6']","pattern_type":"stix","valid_from":"2026-09-14T05:24:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/asyncrat-in-hides-windows-process/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--be233430-4ebd-4483-bc30-9c30a6ac863c","created":"2026-09-14T00:00:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42","description":"Seen in \"The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions\" (Elastic Security Labs). Context: tection For this analysis, we examine the following script: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 . The obfuscation is fairly basic: function names are repla","pattern":"[file:hashes.'SHA-256' = '106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42']","pattern_type":"stix","valid_from":"2026-09-14T00:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Elastic Security Labs","url":"https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb2a53da-48b4-4e93-9d3e-f9c6ae695250","created":"2026-09-14T00:00:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552","description":"Seen in \"The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions\" (Elastic Security Labs). Context: ful pivot for finding additional first-stage samples (e.g., 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 ). The sandbox-detection heuristic consists of two checks.","pattern":"[file:hashes.'SHA-256' = '5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552']","pattern_type":"stix","valid_from":"2026-09-14T00:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Elastic Security Labs","url":"https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2065648b-0480-41fe-8daa-7caca9ad9f76","created":"2026-09-14T00:00:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268","description":"Seen in \"The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions\" (Elastic Security Labs). Context: ugging. For this analysis, we examine the following binary: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 . KREMLIN string decryption algorithm As noted at the begin","pattern":"[file:hashes.'SHA-256' = 'c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268']","pattern_type":"stix","valid_from":"2026-09-14T00:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Elastic Security Labs","url":"https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--44a918bc-e686-4bfe-8303-5c85f3f185c1","created":"2026-09-12T08:04:47.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3","description":"Seen in \"China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks\" (GBHackers). Context: 256 UTA0560 msgbox.exe GRIMWEDGE loader, a Win32 executable 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 SHA-256 JungleBamboo a001 LONGTALE malicious Chrome extensi","pattern":"[file:hashes.'SHA-256' = '5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3']","pattern_type":"stix","valid_from":"2026-09-12T08:04:47.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9661e255-7809-4afb-93d8-4a64641d40a7","created":"2026-09-12T08:04:47.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc","description":"Seen in \"China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks\" (GBHackers). Context: mber 2 phishing URL serving the shared Chrome exploit chain 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc SHA-256 UTA0560 msgbox.exe GRIMWEDGE loader, a Win32 execut","pattern":"[file:hashes.'SHA-256' = '69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc']","pattern_type":"stix","valid_from":"2026-09-12T08:04:47.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc2cfc32-b75e-4b0a-9b3d-199261125e85","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: 056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d54","pattern":"[file:hashes.'SHA-256' = '13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bea0eb34-4ae2-415b-aa0b-765e822ad2de","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b3","pattern":"[file:hashes.'SHA-256' = '6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6eb29382-5408-4190-9ba1-e187a34dfdfc","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: 99c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 sample IP address 160[.]191.242.92 Observed Te","pattern":"[file:hashes.'SHA-256' = '9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fdf8871-439a-4772-8907-28195d6ecf16","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: 92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a9","pattern":"[file:hashes.'SHA-256' = '9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f14801c-321a-4654-94fb-ccbe191b9094","created":"2026-09-11T14:17:53.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218","description":"Seen in \"New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks\" (Cyber Security News). Context: and executed after Telnet credential brute forcing SHA-256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2","pattern":"[file:hashes.'SHA-256' = 'cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218']","pattern_type":"stix","valid_from":"2026-09-11T14:17:53.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/new-kataru-iot-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce768d36-5765-4b31-8064-e37687a9d970","created":"2026-09-11T12:24:51.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c","description":"Seen in \"Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign\" (GBHackers). Context: look ordinary. IOCs SHA-256 File Name File Type Description 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c windirstat.exe PE32 executable; Inno Setup 6.7.1 installer","pattern":"[file:hashes.'SHA-256' = '7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c']","pattern_type":"stix","valid_from":"2026-09-11T12:24:51.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/10000-malware-loaders/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--334d0907-6f7f-424b-9823-89188910c3f0","created":"2026-09-11T12:24:51.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73","description":"Seen in \"Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign\" (GBHackers). Context: at installer distributed through an SEO-poisoning campaign. fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 windirstat.tmp PE32 executable; unpacked Inno Setup stage U","pattern":"[file:hashes.'SHA-256' = 'fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73']","pattern_type":"stix","valid_from":"2026-09-11T12:24:51.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/10000-malware-loaders/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a3bdcce-6862-4881-9c50-d53813b8a02c","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 382be8e1ddbebf3cdf4733cf989ba291f9013 SloppyRAT DLL SHA-256 00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec SloppyRAT DLL SHA-256 93273ea09bd9df881a594db8cfe1b1bbc54f4","pattern":"[file:hashes.'SHA-256' = '00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--138628bb-e7aa-408c-86d2-f43a06af8e72","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: ebdbecb3322453bdc41b2113427f9f92d32d2 SloppyRAT DLL SHA-256 1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd SloppyRAT DLL SHA-256 eaa52d2d6d4daf29157e8e813247fb2e92797","pattern":"[file:hashes.'SHA-256' = '1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a128049-9957-4e1c-b85e-54cce3cdcd7d","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 5e0ee093541d99a9dba5f69a264f7f3054b19 SloppyRAT DLL SHA-256 2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2 SloppyRAT DLL SHA-256 1439990ff65364a0f608a322aa3a493bc1683","pattern":"[file:hashes.'SHA-256' = '2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8913417-2c9a-40bd-86b9-c8275f5ba292","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: a5bcbf9a287d4653de7b76051bde73a94d064 SloppyRAT DLL SHA-256 3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19 SloppyRAT DLL SHA-256 2f3d95de716f330fad2330d8787ebdbecb332","pattern":"[file:hashes.'SHA-256' = '3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c813ecc-2a7e-4ef4-9404-3b1c20fb109b","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 60f6d09ddb5be36cc1766a41d77c5b89d3a56 SloppyRAT DLL SHA-256 466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8 SloppyRAT DLL SHA-256 f534a957edec74d69081665309311b791b6d1","pattern":"[file:hashes.'SHA-256' = '466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a295c4f0-f5af-4686-a63c-7a69ebe01bda","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: d1d8b6e9847aa6b8613493e5bc233ece3d189 SloppyRAT DLL SHA-256 4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56 SloppyRAT DLL SHA-256 466f9b8dce77b3a026fe4f833aa4949784fb8","pattern":"[file:hashes.'SHA-256' = '4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bbbceda-a21b-4660-9f83-cd90590d9fee","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: e3b763bd4a4b0cdf59eeff981d8e307fcf316 SloppyRAT DLL SHA-256 518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064 SloppyRAT DLL SHA-256 3a8994928f512fffcb32e117ac45e0ee09354","pattern":"[file:hashes.'SHA-256' = '518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--440294dc-f78a-448c-9993-b23e766b31d6","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 7374e2234f2a497b19d26637018a1839e6dfd SloppyRAT DLL SHA-256 607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9 SloppyRAT DLL SHA-256 7bb025b426ae6ccbc170fbca58634b8dd77a6","pattern":"[file:hashes.'SHA-256' = '607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--61a0b2c6-53d2-438d-b015-0dbd0ff696a4","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: ebbe05561f3a19c7fc2d08e38c97e1986bbc5 SloppyRAT DLL SHA-256 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SloppyRAT DLL SHA-256 bdcf8fe230e23692b658b62b6547374e2234f","pattern":"[file:hashes.'SHA-256' = '680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b3e9bca-e7f2-479d-b79a-2da063735128","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 34b8dd77a61447e48dabe9c2e2fb0d339d8b7 SloppyRAT DLL SHA-256 6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013 SloppyRAT DLL SHA-256 00c116e498799dc831c8aeb602349296c4b93","pattern":"[file:hashes.'SHA-256' = '6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc5bdbec-5adc-4281-8dde-ad2634cd1fa1","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: f37a47f4c8aad08e6d5cbb7c19a62c6b765f9 SloppyRAT DLL SHA-256 7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7 SloppyRAT DLL SHA-256 6d50bb50d4e7d6ac36ca6d2761f382be8e1dd","pattern":"[file:hashes.'SHA-256' = '7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d3ee0f3-75c3-4c7d-8f76-9d846ab27fa7","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 0a091743cf567396201eff7731f5475768f9a SloppyRAT DLL SHA-256 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990 SloppyRAT DLL SHA-256 ff142fc192daa2a83bc565e5b38ebbe05561f","pattern":"[file:hashes.'SHA-256' = '8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cc7b14c-5660-460f-95c5-e7940bc3a19c","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 49296c4b9325535d674fe2b6e2e091878dcec SloppyRAT DLL SHA-256 93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490 SloppyRAT DLL SHA-256 971f25f84be88c4fd304d555b5e3da12f6b36","pattern":"[file:hashes.'SHA-256' = '93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b6fba5a-99e2-401c-972f-f5a05adf2b4d","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 1b1bbc54f40f623f44427278ae96fb9b46490 SloppyRAT DLL SHA-256 971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d SloppyRAT DLL SHA-256 a13fcbb0870f2fabb7e0a8c757ee3b763bd4a","pattern":"[file:hashes.'SHA-256' = '971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--39db9f32-a06d-4722-9c3c-8ac324c55bca","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a SloppyRAT DLL SHA-256 8774533134d9d1514106c4090a0c5bccab455","pattern":"[file:hashes.'SHA-256' = '9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed47834f-2029-4004-b73b-25ed2acbc156","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 3da12f6b368e4b9ba0943961ff21ba6fa4d4d SloppyRAT DLL SHA-256 a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316 SloppyRAT DLL SHA-256 518cd57a303ff7ac2b5c4c8439aa5bcbf9a28","pattern":"[file:hashes.'SHA-256' = 'a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c2fc5bd-7a43-47bc-9b50-3c08e7b90da2","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SloppyRAT DLL SHA-256 bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd SloppyRAT DLL SHA-256 607212cfe73c5c84b2dd95b2c0ff37a47f4c8","pattern":"[file:hashes.'SHA-256' = 'bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0062722-7bdb-46db-95cd-056b9b76e1bb","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 60b937c7beaf9ab51b03191dfcaba40b7b189 SloppyRAT DLL SHA-256 c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189 SloppyRAT DLL SHA-256 4ecb2d06510dfee1b67f5d9a68c60f6d09ddb","pattern":"[file:hashes.'SHA-256' = 'c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d79c517-871b-4827-a436-164c3ff124ca","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 7fb2e92797324230ee42c79f7861b2f5c341d SloppyRAT DLL SHA-256 cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189 SloppyRAT DLL SHA-256 c0ef62a2d5ca11c2eedad3561d5d1d8b6e984","pattern":"[file:hashes.'SHA-256' = 'cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--91e108fd-1491-49f3-a3e2-df65109b267f","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: a493bc1683cb5fc30cffc44948da29623fffd SloppyRAT DLL SHA-256 eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d SloppyRAT DLL SHA-256 cb9930d0cde5bf8e8a7ad08fe2c60b937c7be","pattern":"[file:hashes.'SHA-256' = 'eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1be1f4c6-4abd-4b6f-92fd-9108cc1eb7fa","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: 4949784fb854bea4137e52609e857d439dec8 SloppyRAT DLL SHA-256 f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb config.py Python script Domain finger.linked4x[.]com ClickF","pattern":"[file:hashes.'SHA-256' = 'f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--900500d4-3715-44cf-b0a6-869aab75f668","created":"2026-09-11T09:12:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (Cyber Security News). Context: c5bccab4550facdcfe03f4e02b9764343a990 SloppyRAT DLL SHA-256 ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5 SloppyRAT DLL SHA-256 680c3a9f5fdddfcc34856c7a67d21bbdd2b47","pattern":"[file:hashes.'SHA-256' = 'ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5']","pattern_type":"stix","valid_from":"2026-09-11T09:12:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--83894ca0-d861-4782-a63d-7445fbebb274","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: nd execute an ARM payload named vlxx.arm, with SHA-256 hash 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4. Staging markers including condi72 and condixx link the del","pattern":"[file:hashes.'SHA-256' = '13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d09d625c-8017-409c-9ee0-7db65811b8ac","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: 634b8031ec254d98b876e59692b5fa22abc1d4 SHA-256 Hash (ARM32) 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f SHA-256 Hash (ARM32) 9d87e6615c810907443ebd5e915f3b35099c3b","pattern":"[file:hashes.'SHA-256' = '6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c494537d-9ad6-40c6-9033-d6037d32d0fd","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: 5f3b35099c3b5c6b6c684637138a7f8ec9cebc SHA-256 Hash (AMD64) 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 IPv4 Address 160[.]191.242.92 Telnet credential brute-force","pattern":"[file:hashes.'SHA-256' = '9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd7f284b-7db8-411e-ba2e-a9fba9bf07a3","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: 2d548ce92dda71e82dc47e8efe13f30617f35f SHA-256 Hash (ARM32) 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc SHA-256 Hash (AMD64) 9d7cd4948a1fcbaeadc425752fce9a933bd6fc","pattern":"[file:hashes.'SHA-256' = '9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--940eeca4-8e1a-4556-9d7d-80fc8cc75905","created":"2026-09-11T09:07:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218","description":"Seen in \"New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks\" (GBHackers). Context: imperfect. IOCs Indicator Type Value SHA-256 Hash (Loader) cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 SHA-256 Hash (ARM32) 13382c16e2401b07451577b46e634b8031ec25","pattern":"[file:hashes.'SHA-256' = 'cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218']","pattern_type":"stix","valid_from":"2026-09-11T09:07:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/iot-malware-attacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--be168fbd-4d18-4b10-8732-b09cef8ae1ab","created":"2026-09-11T07:14:09.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63","description":"Seen in \"China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor\" (The Hacker News). Context: dy running. Gen published the following indicators. SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 malicious DLL loader, written to disk as 7z.dll SHA-256 749","pattern":"[file:hashes.'SHA-256' = '29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63']","pattern_type":"stix","valid_from":"2026-09-11T07:14:09.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--db7922ca-5481-408f-8592-b9cdbf9abe88","created":"2026-09-11T07:14:09.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e","description":"Seen in \"China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor\" (The Hacker News). Context: a63 malicious DLL loader, written to disk as 7z.dll SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e encrypted payload file, named p SHA-256 d7a3c7eb94edc0e020f","pattern":"[file:hashes.'SHA-256' = '749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e']","pattern_type":"stix","valid_from":"2026-09-11T07:14:09.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--92e495c4-fad5-4fd9-a16e-a2c413a94f25","created":"2026-09-11T07:14:09.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a","description":"Seen in \"China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor\" (The Hacker News). Context: 74d675a98662e02422e encrypted payload file, named p SHA-256 d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor, internal name core.dll Domain mail.uai","pattern":"[file:hashes.'SHA-256' = 'd7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a']","pattern_type":"stix","valid_from":"2026-09-11T07:14:09.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eb224e1-dc62-430d-861d-5be3684d7ea0","created":"2026-09-11T07:11:14.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b","description":"Seen in \"UK Council Attack Linked to Mass Exploitation of SonicWall Flaw\" (Security Affairs). Context: ts. The SHA-256 of the Impacket binary the operator used is 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b , and the delivery IP was 95.181.173[.]36. The operator ran","pattern":"[file:hashes.'SHA-256' = '690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b']","pattern_type":"stix","valid_from":"2026-09-11T07:11:14.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Security Affairs","url":"https://securityaffairs.com/198864/hacking/uk-council-attack-linked-to-mass-exploitation-of-sonicwall-flaw.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ff1bc3a-efa2-44be-b6ae-d0b1a99b8ac8","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: be05561f3a19c7fc2d08e38c97e1986bbc5 SHA256 of SloppyRAT DLL 680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SHA256 of SloppyRAT DLL bdcf8fe230e23692b658b62b6547374e223","pattern":"[file:hashes.'SHA-256' = '680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--41d423f2-df29-4ad8-a38c-c530f1b73498","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: 091743cf567396201eff7731f5475768f9a SHA256 of SloppyRAT DLL 8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990 SHA256 of SloppyRAT DLL ff142fc192daa2a83bc565e5b38ebbe0556","pattern":"[file:hashes.'SHA-256' = '8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a05a7a6d-2f55-435c-a970-80a645c23a62","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: vent. Indicators Of Compromise (IOCs) Indicator Description 9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a SHA256 of SloppyRAT DLL 8774533134d9d1514106c4090a0c5bccab4","pattern":"[file:hashes.'SHA-256' = '9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d6f0b74-2dd9-4640-91fd-c7d43ad17470","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: bbdd2b47d70bdfb829ff59cfa0e3bc72d21 SHA256 of SloppyRAT DLL bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd SHA256 of SloppyRAT DLL Note: IP addresses and domains are","pattern":"[file:hashes.'SHA-256' = 'bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3494bb13-f085-45e2-80b9-b6cfaec56d68","created":"2026-09-11T06:17:07.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5","description":"Seen in \"Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement\" (GBHackers). Context: bccab4550facdcfe03f4e02b9764343a990 SHA256 of SloppyRAT DLL ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5 SHA256 of SloppyRAT DLL 680c3a9f5fdddfcc34856c7a67d21bbdd2b","pattern":"[file:hashes.'SHA-256' = 'ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5']","pattern_type":"stix","valid_from":"2026-09-11T06:17:07.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a685637b-b2b3-41f5-b881-b0c0b7533639","created":"2026-09-11T05:30:08.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461","description":"Seen in \"Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware\" (GBHackers). Context: 026-20079 91.214.78[.]118 UAT-11823 Netcat reverse-shell C2 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink ELF malware 43.204.2[.]142 UAT-1198","pattern":"[file:hashes.'SHA-256' = '6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461']","pattern_type":"stix","valid_from":"2026-09-11T05:30:08.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/critical-cisco-fmc-flaws-actively-exploited/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f50d090-b1ed-4142-88ec-cdeb3c04065a","created":"2026-09-11T05:30:08.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d","description":"Seen in \"Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware\" (GBHackers). Context: as MISP, VirusTotal, or your SIEM. IOC Cluster Description b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp JSP web shell db491181ece3f319de6567ab6f","pattern":"[file:hashes.'SHA-256' = 'b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d']","pattern_type":"stix","valid_from":"2026-09-11T05:30:08.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/critical-cisco-fmc-flaws-actively-exploited/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e76d1c2a-1986-47ed-9dbc-bbe3eb2535a4","created":"2026-09-11T05:30:08.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e","description":"Seen in \"Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware\" (GBHackers). Context: fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp JSP web shell db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd.jar JAR-based command executor 89.34.96[.]56","pattern":"[file:hashes.'SHA-256' = 'db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e']","pattern_type":"stix","valid_from":"2026-09-11T05:30:08.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/critical-cisco-fmc-flaws-actively-exploited/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--88489ea2-86ed-4907-a6d6-0bcfea8e35f3","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: -QAD.exe Detection Name: Win.Tool.Procpatcher::1201 SHA256: 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811 MD5: f3e82419a43220a7a222fc01b7607adc Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--27ea2ec7-4f96-4360-b11e-df17b53ab226","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: 001.exe Detection Name: W32.9F1F11A708-100.SBX.TG** SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbffe738-5d6b-4678-b539-7607391f1a63","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: sample.exe Detection Name: W32.C4DD71E347-95.SBX.TG SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f3bee11-d014-4ac4-b1ee-3b3825cc96fa","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = '9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--53f5eef9-3554-4d9e-a9f5-0f7784195d9c","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: 0055df5.dll Detection Name: Auto.90B145.282358.in02 SHA256: c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 MD5: 9a47c4d379998ade2f8f99e23a630c06 Talos Rep: https://ta","pattern":"[file:hashes.'SHA-256' = 'c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f21877e2-2448-47d4-b8e3-19e888971c4e","created":"2026-09-10T14:43:37.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588","description":"Seen in \"SloppyRAT: A New Tool For Ransomware Attacks\" (Zscaler ThreatLabz). Context: application/json User-Agent: CommandExecutor/1.0 X-API-KEY: af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588 Content-Length: 49 Host: api.truesmart.org {\"machine_id\":\"a","pattern":"[file:hashes.'SHA-256' = 'af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588']","pattern_type":"stix","valid_from":"2026-09-10T14:43:37.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Zscaler ThreatLabz","url":"https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--11de1aa3-539d-415e-86a1-a02c8fbb67ac","created":"2026-09-10T13:33:41.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461","description":"Seen in \"Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware\" (Cyber Security News). Context: 079 91.214.78[.]118 UAT-11823 Netcat-based reverse shell C2 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware sample 43.204.2[.]142 UAT-1","pattern":"[file:hashes.'SHA-256' = '6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461']","pattern_type":"stix","valid_from":"2026-09-10T13:33:41.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/cisco-firewall-root-access-flaw/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a92e4733-679a-4c4d-b2d8-920441c656e5","created":"2026-09-10T13:33:41.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d","description":"Seen in \"Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware\" (Cyber Security News). Context: e for all three observed campaigns. IOC Cluster Description b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp — web shell db491181ece3f319de6567ab6f6d","pattern":"[file:hashes.'SHA-256' = 'b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d']","pattern_type":"stix","valid_from":"2026-09-10T13:33:41.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/cisco-firewall-root-access-flaw/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--49047502-2a91-49e8-9e53-7329d1da490c","created":"2026-09-10T13:33:41.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e","description":"Seen in \"Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware\" (Cyber Security News). Context: 54fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp — web shell db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd.jar — JAR-based command executor 89.34.96[.]5","pattern":"[file:hashes.'SHA-256' = 'db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e']","pattern_type":"stix","valid_from":"2026-09-10T13:33:41.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/cisco-firewall-root-access-flaw/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5c7c206-ae4a-4c09-a853-f444ace8a8e7","created":"2026-09-10T12:58:10.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e","description":"Seen in \"Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)\" (SANS Internet Storm Center). Context: le analyzed in this article has the following SHA-256 hash: 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e Dynamic analysis showed that the payload did considerably m","pattern":"[file:hashes.'SHA-256' = '63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e']","pattern_type":"stix","valid_from":"2026-09-10T12:58:10.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"SANS Internet Storm Center","url":"https://isc.sans.edu/diary/rss/33326"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2763fee3-f948-44a5-b9cf-8195d574ba21","created":"2026-09-10T10:00:43.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 40228af4d9a094f0fef2d7a303a3b6a689c4b4eba2fa9f7da5125b81d2d68ec8","description":"Seen in \"The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE\" (Palo Alto Unit 42). Context: pod - image : ghcr .io / spiffe / spire - agent @ sha256 : 40228af4d9a094f0fef2d7a303a3b6a689c4b4eba2fa9f7da5125b81d2d68ec8 \\ \" type : \\ \" k8s \\ \" value : \\ \" pod - label : app : clie","pattern":"[file:hashes.'SHA-256' = '40228af4d9a094f0fef2d7a303a3b6a689c4b4eba2fa9f7da5125b81d2d68ec8']","pattern_type":"stix","valid_from":"2026-09-10T10:00:43.000Z","labels":["auto-extracted","research"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e040176f-42cc-49e7-817d-7aca90580cd2","created":"2026-09-10T10:00:43.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7e1e73513947053f6ee40746fc498b1fb4f285cf175fa8336f08a38e209bda38","description":"Seen in \"The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE\" (Palo Alto Unit 42). Context: 176_ab5c_4f2a_b5f3_3c7e4c91a9ca .slice / cri - containerd - 7e1e73513947053f6ee40746fc498b1fb4f285cf175fa8336f08a38e209bda38.scope We copied this path to a mock cgroup path and wrote o","pattern":"[file:hashes.'SHA-256' = '7e1e73513947053f6ee40746fc498b1fb4f285cf175fa8336f08a38e209bda38']","pattern_type":"stix","valid_from":"2026-09-10T10:00:43.000Z","labels":["auto-extracted","research"],"confidence":30,"external_references":[{"source_name":"Palo Alto Unit 42","url":"https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--32c43463-a876-4e37-acf0-9340a24d1e11","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: rprint associated with 178.128.87[.]160 Certificate SHA-256 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c Certificate fingerprint associated with 178.128.87[.]160 Fi","pattern":"[file:hashes.'SHA-256' = '46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb0a51d7-3dc4-40ef-b49f-92955bd19691","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: erprint associated with 165.22.184[.]26 Certificate SHA-256 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 Certificate fingerprint associated with 178.128.87[.]160 Ce","pattern":"[file:hashes.'SHA-256' = '4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa151f19-801c-4743-821a-8eb755ee0caf","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: SockTz installers and campaign scripts Certificate SHA-256 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 Certificate fingerprint associated with 165.22.184[.]26 Cer","pattern":"[file:hashes.'SHA-256' = '7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fb435d1-49a6-467d-910e-31bf54c953a9","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: zilian financial campaign malware or tool hash File SHA-256 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec Brazilian financial campaign malware or tool hash URL hxxp[","pattern":"[file:hashes.'SHA-256' = '87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5297482d-17e8-452b-bd12-65d806712f37","created":"2026-09-10T08:06:02.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996","description":"Seen in \"Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks\" (Cyber Security News). Context: e fingerprint associated with 178.128.87[.]160 File SHA-256 a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 Brazilian financial campaign malware or tool hash File SHA-","pattern":"[file:hashes.'SHA-256' = 'a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996']","pattern_type":"stix","valid_from":"2026-09-10T08:06:02.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/gpt-powered-tools/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--52d57180-ac16-420b-a68e-0041d583573d","created":"2026-09-10T07:01:43.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11","description":"Seen in \"Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.\" (GBHackers). Context: stores. IOCs Indicator Type Value Description SHA-256 Hash 9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11 Native Mach-O Stager Binary MD5 Hash 9678f71ea4cccbc3d511dc","pattern":"[file:hashes.'SHA-256' = '9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68aeadc44eeb97c9aab11']","pattern_type":"stix","valid_from":"2026-09-10T07:01:43.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/clickfix-lures-target-macos/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0deb4a2-51b9-43eb-90ac-0e0d3bc2fdd5","created":"2026-09-10T06:02:43.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c","description":"Seen in \"Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America\" (GBHackers). Context: ingerprint Corresponding Host/IP m-doxa-apodo.duckdns[.]org 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c 178.128.87[.]160 m-doxa-geo.duckdns[.]org 4e218e70afdbb1162","pattern":"[file:hashes.'SHA-256' = '46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c']","pattern_type":"stix","valid_from":"2026-09-10T06:02:43.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/llm-powered-cyberattacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf308734-7c46-482a-b019-2dfb0a68eaa1","created":"2026-09-10T06:02:43.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5","description":"Seen in \"Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America\" (GBHackers). Context: bec02f63776d3899c 178.128.87[.]160 m-doxa-geo.duckdns[.]org 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 178.128.87[.]160 m-doxa-intel.duckdns[.]org 7d766942ef34542","pattern":"[file:hashes.'SHA-256' = '4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5']","pattern_type":"stix","valid_from":"2026-09-10T06:02:43.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/llm-powered-cyberattacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e3e16a2-4dc6-45d1-8597-c1c96c255b38","created":"2026-09-10T06:02:43.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8","description":"Seen in \"Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America\" (GBHackers). Context: b83c0e863a8fee5 178.128.87[.]160 m-doxa-intel.duckdns[.]org 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 165.22.184[.]26 Note: IP addresses and domains are intentio","pattern":"[file:hashes.'SHA-256' = '7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8']","pattern_type":"stix","valid_from":"2026-09-10T06:02:43.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/llm-powered-cyberattacks/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--23acae9e-d4f4-4e8c-ae74-3d6f79629292","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 3d2cd6b697c40adfee1a4f6fe18f004 SHA256 dist.zip August 2026 353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee SHA256 background.js August 2026 secboxes[.]com Domain TA41","pattern":"[file:hashes.'SHA-256' = '353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--83f859a8-1a4b-4db1-9186-dda3631c6c21","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: ploitation. Ioc TA412 Indicator Type Description First Seen 779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d SHA256 driver-html.js(BlueMoon exploit JavaScript) August 2","pattern":"[file:hashes.'SHA-256' = '779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b10a03f7-8137-4a74-b197-118657e8ed7d","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 09fba35d782b SHA256 BlueMoon exploit JavaScript August 2026 7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288 SHA256 ChromeUpdate.exe (or msgbox.exe) August 2026 e950d03","pattern":"[file:hashes.'SHA-256' = '7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0263d758-3e53-4007-80be-d9429eba6528","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 1f82288 SHA256 ChromeUpdate.exe (or msgbox.exe) August 2026 e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004 SHA256 dist.zip August 2026 353b5bd2780c1b0c07c1283d83cf16c","pattern":"[file:hashes.'SHA-256' = 'e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ef1ff4b-ceaf-4504-897d-fb420cce831e","created":"2026-09-10T05:15:03.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b","description":"Seen in \"China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks\" (GBHackers). Context: 256 driver-html.js(BlueMoon exploit JavaScript) August 2026 ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b SHA256 BlueMoon exploit JavaScript August 2026 7d6f6dcb17a4","pattern":"[file:hashes.'SHA-256' = 'ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b']","pattern_type":"stix","valid_from":"2026-09-10T05:15:03.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/china-linked-hackers-exploit-chrome-and-windows-zero-days/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--18b742e7-cebf-4a8e-9304-64f3c7522f91","created":"2026-09-09T16:08:59.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461","description":"Seen in \"Active exploitation of Cisco Secure Firewall Management Center vulnerabilities\" (Cisco Talos). Context: 9. 91.214.78[.]118 UAT-11823 NetCat-based reverse shell C2. 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware. 43.204.2[.]142 UAT-11988 A","pattern":"[file:hashes.'SHA-256' = '6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461']","pattern_type":"stix","valid_from":"2026-09-09T16:08:59.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9951f783-b855-4354-aa53-bd714541f049","created":"2026-09-09T16:08:59.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d","description":"Seen in \"Active exploitation of Cisco Secure Firewall Management Center vulnerabilities\" (Cisco Talos). Context: ble on our GitHub repository here . IOC Cluster Description B037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home[.]jsp – web shell. Db491181ece3f319de6567ab6","pattern":"[file:hashes.'SHA-256' = 'b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d']","pattern_type":"stix","valid_from":"2026-09-09T16:08:59.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--75747e23-2a32-4523-9b70-ab3aa21224c0","created":"2026-09-09T16:08:59.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e","description":"Seen in \"Active exploitation of Cisco Secure Firewall Management Center vulnerabilities\" (Cisco Talos). Context: d0fdfd07162cb4eb2acbef77d UAT-12197 home[.]jsp – web shell. Db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd[.]jar – JAR-based command executor. 89.34.96[","pattern":"[file:hashes.'SHA-256' = 'db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e']","pattern_type":"stix","valid_from":"2026-09-09T16:08:59.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5941fb97-0634-4f74-a474-c399921743b2","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: ode payload used to deploy the Go reverse TCP proxy SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 Unpacked Go-based reverse TCP proxy executable WebSocket C2","pattern":"[file:hashes.'SHA-256' = '1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3065edc2-0a95-4858-99ee-bca4dbce2b76","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: ation.google Amatera build during C2 communications SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 ZIP archive containing the DLL side-loading package File na","pattern":"[file:hashes.'SHA-256' = '279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--02e99ade-4d5c-43ad-bf03-51afcf308235","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: ce\\DCRCVDRV_U Driver device exposed by DCRCVDrv.sys SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 Shellcode payload used to deploy the Go reverse TCP proxy S","pattern":"[file:hashes.'SHA-256' = '643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8043cd3-3a3b-42d5-829a-b4fa06451063","created":"2026-09-09T14:26:47.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b","description":"Seen in \"ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools\" (Cyber Security News). Context: g ZIP payload retrieved by the PowerShell installer SHA-256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b ZIP archive containing the unauthorized remote-access deplo","pattern":"[file:hashes.'SHA-256' = 'bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b']","pattern_type":"stix","valid_from":"2026-09-09T14:26:47.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/clearfake-deploys-crypto-stealer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c36573e-e969-4fa9-8f5c-a3c65c7a09cb","created":"2026-09-09T14:07:24.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7","description":"Seen in \"Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7 NodeRabbit-related sample identified by PolySwarm SHA-256 3","pattern":"[file:hashes.'SHA-256' = '123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7']","pattern_type":"stix","valid_from":"2026-09-09T14:07:24.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-use-fake-linkedin-job-offers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--700561f8-75fc-44e5-9bf9-ca4f6d26eb42","created":"2026-09-09T14:07:24.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00","description":"Seen in \"Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs\" (Cyber Security News). Context: 7 NodeRabbit-related sample identified by PolySwarm SHA-256 307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00 NodeRabbit-related sample identified by PolySwarm Note: IP","pattern":"[file:hashes.'SHA-256' = '307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00']","pattern_type":"stix","valid_from":"2026-09-09T14:07:24.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-use-fake-linkedin-job-offers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cdfefd4-591c-4e38-ae6a-e7f69ef5b91b","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 28a3eadc0b509386cae200993b33673b343c Gigabud sample SHA-256 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3 Vwork sample SHA-256 66499653c0fff78d81db5dc319b9aaa0288dc5","pattern":"[file:hashes.'SHA-256' = '0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7663387-018b-46cf-85e4-dc2b859d5177","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 1009dda5b93ed3d1cead527b02d1317426bc Gigabud sample SHA-256 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud sample SHA-256 9ca27df7938f12794bab0847434482955ca9","pattern":"[file:hashes.'SHA-256' = '112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa331e8d-6bcf-4600-aca6-43e2c3f70d4f","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 82955ca9adea714a34afd315c7a7be522611 Gigabud sample SHA-256 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud sample SHA-256 0710ca983741bf6a95db1b6960c1985e45b1","pattern":"[file:hashes.'SHA-256' = '1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e3bba9d-c661-435a-90de-8997c81a7ad7","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 7986e52f913f4b5ff960ddea26075ff621ae Gigabud sample SHA-256 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud sample SHA-256 112fefc9348fa4acbb82d54d9688c96dd567","pattern":"[file:hashes.'SHA-256' = '4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a54b2f8-e524-467d-a5b7-437f46d4fcd3","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: a73660c0ee810eb Modified banking application sample SHA-256 61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc Modified banking application sample Android package net.yy.","pattern":"[file:hashes.'SHA-256' = '61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--077e5daa-ac7c-4058-a09c-09fc1a070229","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: c1985e45b10f276e5b26f4fae3157db283d1f3 Vwork sample SHA-256 66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb Modified banking application sample SHA-256 61274cf9f49e04e","pattern":"[file:hashes.'SHA-256' = '66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed62d210-f06e-43e3-bb77-74adb21ed54a","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud sample SHA-256 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud sample SHA-256 1f5d99864564c088a3260e54ad1728a3eadc","pattern":"[file:hashes.'SHA-256' = '9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--59069302-a2fe-4a09-bcd4-1d5690cbaa6b","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: 1bc772c8383a4149d23a5425b13475e2d501 Gigabud sample SHA-256 ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud sample SHA-256 4fff28eecc0ab6303e4948df77671009dda5","pattern":"[file:hashes.'SHA-256' = 'ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8da9b3c-5c53-4e14-81f7-c6e7369bfaaa","created":"2026-09-09T13:11:36.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501","description":"Seen in \"Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud sample SHA-256 ae6f6eeba2bd4cc948d24610d9447986e52f","pattern":"[file:hashes.'SHA-256' = 'b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501']","pattern_type":"stix","valid_from":"2026-09-09T13:11:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-clone-banking-apps/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d0c73e8-848f-4a71-8b84-efa68ae04900","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: ( 7c1d255d0efefde6 ) ScreenConnect.ClientSetup.exe SHA256: 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b Initial payload: rogue ScreenConnect installer HideCursor.e","pattern":"[file:hashes.'SHA-256' = '41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--df291b4f-ebff-4772-b2af-0a18550d362a","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: sion binary ScreenConnect Client (9c1aea531ba4c511) SHA256: 9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991 Rogue RMM: initial ScreenConnect instance ScreenConnect Cli","pattern":"[file:hashes.'SHA-256' = '9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--33c21434-0a74-42c5-9b1d-5c5b1079c316","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: ct instance ScreenConnect Client (7c1d255d0efefde6) SHA256: f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 Rogue RMM: secondary rogue ScreenConnect instance Incident","pattern":"[file:hashes.'SHA-256' = 'f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--269d4a7e-fd33-4248-9967-a979bbbc5d45","created":"2026-09-09T13:00:00.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2","description":"Seen in \"Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence\" (Huntress). Context: yload: rogue ScreenConnect installer HideCursor.exe SHA256: fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2 Defense evasion binary ScreenConnect Client (9c1aea531ba4c5","pattern":"[file:hashes.'SHA-256' = 'fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2']","pattern_type":"stix","valid_from":"2026-09-09T13:00:00.000Z","labels":["auto-extracted","phishing-fraud"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/phishing-bitb-rmm-attacks"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f8948e7-7d02-4353-85d6-b189c3d100ab","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3 Note: IP addresses and domains are intentionally defanged (","pattern":"[file:hashes.'SHA-256' = '0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--24fed418-c271-4138-a39b-be752824842a","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud 9ca27df7938f12794bab0847434482955ca9adea714a34afd31","pattern":"[file:hashes.'SHA-256' = '112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a17a6c27-80c8-46ba-97ed-10da6410ddb9","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 2794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae","pattern":"[file:hashes.'SHA-256' = '1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--424d24ed-87e7-44cf-95ca-fad0f349bbeb","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f","pattern":"[file:hashes.'SHA-256' = '4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--250e7a7f-c631-4e0d-8344-c227ce313b19","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae2009","pattern":"[file:hashes.'SHA-256' = '9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--21d28efa-9e24-45d8-935f-cd1f89d3ca52","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: 0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527","pattern":"[file:hashes.'SHA-256' = 'ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c4f3d96-a7aa-460c-9ec5-f1bcd2a61f31","created":"2026-09-09T10:49:58.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501","description":"Seen in \"GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks\" (GBHackers). Context: horized transfers. IOCs Malware Family SHA-256 Hash Gigabud b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960dde","pattern":"[file:hashes.'SHA-256' = 'b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501']","pattern_type":"stix","valid_from":"2026-09-09T10:49:58.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/gigabud-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c49cc61-9cb6-4fec-9df0-34a5f659c166","created":"2026-09-09T08:50:44.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9","description":"Seen in \"PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory\" (Security Affairs). Context: upgrade images. The SHA-256 hash of the analyzed sample is 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 . F5 has published remediation and compromise assessment gu","pattern":"[file:hashes.'SHA-256' = '26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9']","pattern_type":"stix","valid_from":"2026-09-09T08:50:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Security Affairs","url":"https://securityaffairs.com/198746/malware/poisonedrefresh-a-fileless-linux-rootkit-that-injects-php-web-shells-into-f5-big-ip-apm-server-memory.html"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c890005d-1233-42c7-b511-a4f0204f2187","created":"2026-09-09T07:47:48.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a","description":"Seen in \"Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners\" (Cyber Security News). Context: identifier observed in the RDP certificate TLS fingerprint 420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a Pinned mining-pool certificate fingerprint in the newest pa","pattern":"[file:hashes.'SHA-256' = '420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a']","pattern_type":"stix","valid_from":"2026-09-09T07:47:48.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/hackers-turn-redis-servers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9b724ae-5092-41f4-be10-b8f3e24fecab","created":"2026-09-09T07:36:49.000Z","modified":"2026-09-15T22:16:21.587Z","created_by_ref":"identity--186db14a-6d51-4e72-ae3a-ab33eaaf106b","name":"sha256: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9","description":"Seen in \"F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans\" (The Hacker News). Context: inding a socket under /run, or starting /bin/bash SHA-256 : 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 File, weak on its own : changes to the three .php3 scripts.","pattern":"[file:hashes.'SHA-256' = '26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9']","pattern_type":"stix","valid_from":"2026-09-09T07:36:49.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"The Hacker News","url":"https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html"}]}]}