Indicators of compromise
1,370 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| sha256 | 9e6671a8af28e0ab6c37c044d85a2406b665a171ae3bef46f3e90d06e33027ae | c14153e983ae7ab793c7cd0e5ac3faf8e200894955b02e1191429eff29a 9e6671a8af28e0ab6c37c044d85a2406b665a171ae3bef46f3e90d06e33027ae 448c33094322b200c53ff016fec29469b3e52def359430113115cc70d7f | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a05805bcec72fb76b997c456e0fd6c4b219fdc51cad70d4a58c16b0b0e2d9ba1 | 3492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3 a05805bcec72fb76b997c456e0fd6c4b219fdc51cad70d4a58c16b0b0e2d9ba1 4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227c | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3 | a21d953c394968647df6a37e1f61db04968ad1aca65ad8f261b363fa842 a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3 4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a545288c4d491d510972d583b773f8a0c5dc355942e322cf767d33121c659c1c | 3ff35104a032dd047ca39d35ec98601c76aa02f58ad655df6deaadecb55 a545288c4d491d510972d583b773f8a0c5dc355942e322cf767d33121c659c1c 64a9bdf4ff33e8f2e74dc16d7dce0f392aa130ff9b99458778fd25d9aad | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ae8fb2f138981f10092761768428fb312e3e49bc23d5b610e3127c1a387aede8 | 955db80cb5835158320ba94b2b55bc7028ea988b75f02adee3df40793f3 ae8fb2f138981f10092761768428fb312e3e49bc23d5b610e3127c1a387aede8 66f43e57648f01ea5f8d0d152db1df90c764eebeb701403936a15c47e29 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b01b7a5798f41a5fae54b4189db6f47c6110a0b53a4df32cb7d0f13503c5250c | 0d6a988723b33158bbeef4ab90b1bff7b521fed9cab0c5e1f5b69a01de5 b01b7a5798f41a5fae54b4189db6f47c6110a0b53a4df32cb7d0f13503c5250c fb63acfda1730132dbfbf1d46834d771156aac3f7c8e97ea136ca6edbe8 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b742162197744a8caeb09f954213a3172ed699f8375f69c40b57b8c219c5e37c | ll look at the most recent version of Cardinal RAT : SHA256 b742162197744a8caeb09f954213a3172ed699f8375f69c40b57b8c219c5e37c The l ast time we wrote about Cardinal RAT in 2017 , we loo | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bae230d6a988723b33158bbeef4ab90b1bff7b521fed9cab0c5e1f5b69a01de5 | 34200668ac64cb63fc1a4f4ea17e956f6928a2211c945c2e07f1b25a3ef bae230d6a988723b33158bbeef4ab90b1bff7b521fed9cab0c5e1f5b69a01de5 b01b7a5798f41a5fae54b4189db6f47c6110a0b53a4df32cb7d0f13503c | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bee6c5a506d6fb2cc129443c74b7676fbb9a79b53b92b2cac4c7fb8209592714 | ten in JavaScript, and another written in .NET. SHA256 Type bee6c5a506d6fb2cc129443c74b7676fbb9a79b53b92b2cac4c7fb8209592714 .NET 97c97ad2baef37eea023549131c192f441aa7976747166cd31095e | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ca2a01792873233693e17fe51c4c86c05d07e31f9b579ab0444dd89733633532 | f39e54457fcfa21f5a8ed0f04095c1d4b798453770be5dda5db7d5406ac ca2a01792873233693e17fe51c4c86c05d07e31f9b579ab0444dd89733633532 4fde64e9391d36aaff700ce0be3df9e7e6303b6de114332286de694af33 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ca8af85f7eed79a73984b2dccd3dd2148865dfed7a009842be7372e6ce18037f | 48c8a2ffab67627556075ddcad92998526d4d3802b9c2357d169531825f ca8af85f7eed79a73984b2dccd3dd2148865dfed7a009842be7372e6ce18037f 75ca794f265ebad84954f13480e0e31c17048d21c4b52e949864c951437 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cbcb627ff2220ed269aaa58203e7e89f1988210073d35f5f4019f8ecfd012f81 | 17396e2ddfce8e60c964056d63cc3b17646c31b4a4f934c2d1fb4f5ba71 cbcb627ff2220ed269aaa58203e7e89f1988210073d35f5f4019f8ecfd012f81 267b1df7bc64c1b93b604d964f52801733fdd43efaf7742810b9277f00a | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dab228c236d48fa1660bcec59e17e5004726741a85b0fbeef8300f29927c32d9 | 2d1824b585aa558b7cf9e9980acd665736ce9f7a124507cf46afb30c79f dab228c236d48fa1660bcec59e17e5004726741a85b0fbeef8300f29927c32d9 f75883ff35104a032dd047ca39d35ec98601c76aa02f58ad655df6deaad | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dd8fe0e27bf798cace40ac0d58b833ba3bbf16d80175296601585ed1964465ec | c45ca3d4d4ce33981f660d23e8df4a9c0e345fdd6429d8b46f6c0528c38 dd8fe0e27bf798cace40ac0d58b833ba3bbf16d80175296601585ed1964465ec 20fec2d1824b585aa558b7cf9e9980acd665736ce9f7a124507cf46afb3 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dfa041f6cbe9d83cdaaed90466693efca33729c99fa43b29ab8e44bb27eb0a6b | 528fc1b90b725d857cc5d45572e864c6c4948100458774f0ef6a8f11403 dfa041f6cbe9d83cdaaed90466693efca33729c99fa43b29ab8e44bb27eb0a6b 4045950ffa263b92774e92ab36b3ec52bf18f1c133b8d155819629d2ad4 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39aec3bd | df7bc64c1b93b604d964f52801733fdd43efaf7742810b9277f00ad17ff e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39aec3bd 778090182a10fde1b4c1571d1e853e123f6ab1682e17dabe2e83468b518 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ebd4f45cbb272bcc4954cf1bd0a5b8802a6e501688f2a1abdb6143ba616aea82 | 79517fed71682423b0192da453ec1d61a633c154fdd55bab762bcc404f3 ebd4f45cbb272bcc4954cf1bd0a5b8802a6e501688f2a1abdb6143ba616aea82 edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67a | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67aac305 | 45cbb272bcc4954cf1bd0a5b8802a6e501688f2a1abdb6143ba616aea82 edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67aac305 7482f8c86b63ce53edcb62fc2ff2dd8e584e2164451ae0c6f2b1f4d6d0c | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f027735c3db77e67cf7bada8862ddbb0d85a2caacbb4b2825e4acdfa863a14c9 | d349cf841d0f25e81d80a1b4bf73dd960a1f3aa71029a18e36480c80392 f027735c3db77e67cf7bada8862ddbb0d85a2caacbb4b2825e4acdfa863a14c9 75996bbfcd2b343523ed79476f9516cc7d2b041c43841e5e735db4f22ae | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f4f52c45ca3d4d4ce33981f660d23e8df4a9c0e345fdd6429d8b46f6c0528c38 | 29e5dae8677f9db3aa7eaa96ad584c872343698e18f85349a027328b3ea f4f52c45ca3d4d4ce33981f660d23e8df4a9c0e345fdd6429d8b46f6c0528c38 dd8fe0e27bf798cace40ac0d58b833ba3bbf16d80175296601585ed1964 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f75883ff35104a032dd047ca39d35ec98601c76aa02f58ad655df6deaadecb55 | 8c236d48fa1660bcec59e17e5004726741a85b0fbeef8300f29927c32d9 f75883ff35104a032dd047ca39d35ec98601c76aa02f58ad655df6deaadecb55 a545288c4d491d510972d583b773f8a0c5dc355942e322cf767d33121c6 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f9bccd349cf841d0f25e81d80a1b4bf73dd960a1f3aa71029a18e36480c80392 | 6fdb990e5e9584382a65f5cee7efd9e89c38e928beca18419bdf70ef076 f9bccd349cf841d0f25e81d80a1b4bf73dd960a1f3aa71029a18e36480c80392 f027735c3db77e67cf7bada8862ddbb0d85a2caacbb4b2825e4acdfa863 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fb63acfda1730132dbfbf1d46834d771156aac3f7c8e97ea136ca6edbe811fad | a5798f41a5fae54b4189db6f47c6110a0b53a4df32cb7d0f13503c5250c fb63acfda1730132dbfbf1d46834d771156aac3f7c8e97ea136ca6edbe811fad 268c3c9a98f2a15aaab9b0488225b0ba4e3d35efa30f6fed9052ffd3104 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fc5f7a21d953c394968647df6a37e1f61db04968ad1aca65ad8f261b363fa842 | a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db fc5f7a21d953c394968647df6a37e1f61db04968ad1aca65ad8f261b363fa842 a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fd61a5cd1a83f68b75d47c8b6041f8640e47510925caee8176d5d81afac29134 | b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2 fd61a5cd1a83f68b75d47c8b6041f8640e47510925caee8176d5d81afac29134 84f822d9cf575aeea867e9b73f88ad4d9244293e52208644e12ff2cf13b | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2a7da0a0acadb61fb79fa4a33130d09ecff5a904b0999d264d8c1edffeffea95 | ion = "the HERCULES malware family written in Go." hash1 = "2a7da0a0acadb61fb79fa4a33130d09ecff5a904b0999d264d8c1edffeffea95" hash2 = "6e68dafbb717daf6a505d8a95c41e5114d91c4fde70334335 | The Gopher in the Room: Analysis of GoLang Malware in the Wild Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 645ed38f2d55b2f7731d5c9223329428592497eb95c96bcd7c01a4eaeb38e137 | 6a505d8a95c41e5114d91c4fde703343356352c1ca5cd24ea" hash3 = "645ed38f2d55b2f7731d5c9223329428592497eb95c96bcd7c01a4eaeb38e137" reference = "https://github.com/EgeBalci/HERCULES" strings | The Gopher in the Room: Analysis of GoLang Malware in the Wild Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6e68dafbb717daf6a505d8a95c41e5114d91c4fde703343356352c1ca5cd24ea | fb79fa4a33130d09ecff5a904b0999d264d8c1edffeffea95" hash2 = "6e68dafbb717daf6a505d8a95c41e5114d91c4fde703343356352c1ca5cd24ea" hash3 = "645ed38f2d55b2f7731d5c9223329428592497eb95c96bcd7 | The Gopher in the Room: Analysis of GoLang Malware in the Wild Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fc684bbf9428a4e33c390e3963c9bfa24e81cb040ccd601c6e7f5b6c193e2808 | running this is below: $ python find_interesting_strings.py fc684bbf9428a4e33c390e3963c9bfa24e81cb040ccd601c6e7f5b6c193e2808.bin 'main.encryptFile' 'main.writeLog.func1' 'main.writeLog | The Gopher in the Room: Analysis of GoLang Malware in the Wild Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 | 21ab420c443ab7b15ed42aed91fd31ce833896 Malicious ffmpeg.dll 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 Malicious d3dcompiler_47.dll c485674ee63ec8d4e8fde980078817 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de | e6e6e3182 icon6.ico hxxps://officeaddons[.]com/technologies 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de icon7.ico hxxps://sourceslabs[.]com/downloads e059c8c8b01d6 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca | c1789f icon2.ico hxxps://officestoragebox[.]com/api/session 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca icon3.ico hxxps://visualstudiofactory[.]com/workload c62dce | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f | 651ba71027e4d3 icon15.ico hxxps://pbxsources[.]com/exchange 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f icon2.ico hxxps://officestoragebox[.]com/api/session 268d4e | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f | a icon12.ico hxxps://azureonlinestorage[.]com/azure/storage 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f icon13.ico hxxps://msedgepackageinfo[.]com/microsoft-edge 8 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 | f9be345823b4fdcf5d868 3CXDesktopApp-18.12.407.msi Installer 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 3CXDesktopApp-18.11.1213.dmg Installer e6bbc33815b9f20b0cf8 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 | main protected. Indicators of Compromise SHA256 Description 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3CXDesktopApp-18.12.416.msi Installer aa124a4b4df12b34e74ee | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 | c6010a4297e321 3CXDesktopApp-18.12.416-full.nupkg Installer 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 Malicious ffmpeg.dll 11be1803e2e307b647a8a7e02d128335c448ff | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7c55c3dfa373b6b342390938029cb76ef31f609d9a07780772c6010a4297e321 | 28b5891336706da0dbcec 3CXDesktopApp-18.12.416.dmg Installer 7c55c3dfa373b6b342390938029cb76ef31f609d9a07780772c6010a4297e321 3CXDesktopApp-18.12.416-full.nupkg Installer 7986bbaee8940d | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d | f icon13.ico hxxps://msedgepackageinfo[.]com/microsoft-edge 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d icon14.ico hxxps://glcloudservice[.]com/v1/console f47c883f | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c | from within the file. SHA256 Icon Filename C2 URL Extracted a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c icon1.ico hxxps://msstorageazure[.]com/window d459aa0a63140 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 | 573e5d9973caa676f58086c99561382d7 Malicious libffmpeg.dylib a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 Malicious libffmpeg.dylib URL Description msstorageazure[.] | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 | 850ba46794d9c7a2c0983 3CXDesktopApp-18.12.416.msi Installer aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 3CXDesktopApp-18.12.407.msi Installer 5407cda7d3a75e7b1e030 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973 | 88175a8b02d3f9416d0e763360fff7f8eb4e02 Malicious ffmpeg.dll aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973 Malicious DLL in d3dcompiler_47.dll fee4f9dabc094df24d83ec1 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 | 9bd icon4.ico hxxps://azuredeploystore[.]com/cloud/services c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 icon5.ico hxxps://msstorageboxes[.]com/office f1bf4078141d7 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 | 48ff741bf06bf52b332e0bbf423b03 Malicious d3dcompiler_47.dll c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 Malicious ffmpeg.dll aa4e398b3bd8645016d8090ffc77d15f926a8e | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd | 14beca icon3.ico hxxps://visualstudiofactory[.]com/workload c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd icon4.ico hxxps://azuredeploystore[.]com/cloud/services c13 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e | b1e0db2071c3425c icon8.ico hxxps://zacharryblogs[.]com/feed d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e icon9.ico hxxps://pbxcloudeservices[.]com/phonesystem Table | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 | 1baa5fbb8e25c icon1.ico hxxps://msstorageazure[.]com/window d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 icon10.ico and icon11.ico hxxps://akamaitechcloudservices[. | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a | icon11.ico hxxps://akamaitechcloudservices[.]com/v2/storage d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a icon12.ico hxxps://azureonlinestorage[.]com/azure/storage 4 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c | 2efcc4d9da6de icon7.ico hxxps://sourceslabs[.]com/downloads e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c icon8.ico hxxps://zacharryblogs[.]com/feed d0f1984b4fe896d0 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec | 3ae19c671051ed314290 3CXDesktopApp-18.11.1213.dmg Installer e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 3CXDesktopApp-18.12.416.dmg Installer 7c55c3dfa373b6b342390 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 | b2ba4bb176396 icon5.ico hxxps://msstorageboxes[.]com/office f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 icon6.ico hxxps://officeaddons[.]com/technologies 2487b4e3c | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 | defa6b2d icon14.ico hxxps://glcloudservice[.]com/v1/console f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 icon15.ico hxxps://pbxsources[.]com/exchange 2c9957ea04d033 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 | 58642191deb4e68688ff973 Malicious DLL in d3dcompiler_47.dll fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 Malicious libffmpeg.dylib a64fa9f1c76457ecc58402142a8728ce3 | Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated) Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 018beb515d323dee4f04ad9663863324859f4eb896576dbef1df950568084030 | c4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 com 018beb515d323dee4f04ad9663863324859f4eb896576dbef1df950568084030 enlace bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d985 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 | 498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 nbem 0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 nixe 974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f | fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f | 8e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7a | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0 | e4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0 e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 | d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 mx 3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 nbem 0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0ce1d64f944a | 733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 www1 44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0ce1d64f944a www2 Table 2. Brute-forced strings used to target specific | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52 | 5289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 | dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 www 4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 ixe 4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f | 15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 ixe 4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f monex e8deebe849f80654b53b73d41a379919a86c4c356715d34729335 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 | ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 We observed a total of 15 groupings of hashes for this malw | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 | bf7f4513b64658c751148304f287b13df26890642d64b75c264 bbvanet 4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 hsbcnet b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 | 486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 hsbc 748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 mx 3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea | wn in Table 1 for our analysis: Characteristic Value SHA256 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea SHA1 ba6d10e36f41c4ebc85f6beb95afd2b7c92406ad MD5 723df0296 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 | d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 nixe 974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 see ac027e988dad213707537bdc0172509b9135115337c5744816b0793 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ac027e988dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 | 2905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 see ac027e988dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 www 4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 | aa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 hsbcnet b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 www1 44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0c | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 | 3dee4f04ad9663863324859f4eb896576dbef1df950568084030 enlace bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 hsbc 748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf61 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bc25f7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789 | 54dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea bc25f7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789 fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cf546a4c5c7fdd3935ed7d93f5482057e3c8ff8723c3a73caba1fc5e3a5c96b4 | ying strings, as noted below in Table 2. SHA256 Hash String cf546a4c5c7fdd3935ed7d93f5482057e3c8ff8723c3a73caba1fc5e3a5c96b4 bitso 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff9 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 | 0654b53b73d41a379919a86c4c356715d34729335e79089127c7 secure d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 wallet d752b7472110cbf7f4513b64658c751148304f287b13df268906 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d752b7472110cbf7f4513b64658c751148304f287b13df26890642d64b75c264 | 9707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 wallet d752b7472110cbf7f4513b64658c751148304f287b13df26890642d64b75c264 bbvanet 4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dd4018e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3 | he prepended hash, resulting in the following three hashes: dd4018e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d38 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036a22ea | 569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0 e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036a22ea Network… | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e8deebe849f80654b53b73d41a379919a86c4c356715d34729335e79089127c7 | 450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f monex e8deebe849f80654b53b73d41a379919a86c4c356715d34729335e79089127c7 secure d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f725 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4 | 7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789 fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467 | Exploring the Latest Mispadu Stealer Variant Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7fc8d002b89fcfeb1c1e6b0ca710d7603e7152f693a14d8c0b7514d911d04234 | IoCs is available on our GitHub. Indicator Type Description 7fc8d002b89fcfeb1c1e6b0ca710d7603e7152f693a14d8c0b7514d911d04234 File CVE-2023-40477-main.zip ecf96e8a52d0b7a9ac33a37ac8b277 | Fake CVE-2023 Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b77e4af833185c72590d344fd8f555b95de97ae7ca5c6ff5109a2d204a0d2b8e | 5afd287915c50a92df244e5041715c3381733e30b666fd3b File c.ps1 b77e4af833185c72590d344fd8f555b95de97ae7ca5c6ff5109a2d204a0d2b8e File Windows.Gaming.Preview.exe - VenomRAT 94.156.253[.]109 | Fake CVE-2023 Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b99161d933f023795afd287915c50a92df244e5041715c3381733e30b666fd3b | f0c3d95514ac6eeaeacd8a4b62bcc32a716639f7e62cc4 File bat.bat b99161d933f023795afd287915c50a92df244e5041715c3381733e30b666fd3b File c.ps1 b77e4af833185c72590d344fd8f555b95de97ae7ca5c6ff5 | Fake CVE-2023 Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c2a2678f6bb0ff5805f0c3d95514ac6eeaeacd8a4b62bcc32a716639f7e62cc4 | c33a37ac8b2779f4c52a3d7e0cf8da09d562ba0de6b30ff File poc.py c2a2678f6bb0ff5805f0c3d95514ac6eeaeacd8a4b62bcc32a716639f7e62cc4 File bat.bat b99161d933f023795afd287915c50a92df244e5041715c | Fake CVE-2023 Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ecf96e8a52d0b7a9ac33a37ac8b2779f4c52a3d7e0cf8da09d562ba0de6b30ff | 7152f693a14d8c0b7514d911d04234 File CVE-2023-40477-main.zip ecf96e8a52d0b7a9ac33a37ac8b2779f4c52a3d7e0cf8da09d562ba0de6b30ff File poc.py c2a2678f6bb0ff5805f0c3d95514ac6eeaeacd8a4b62bcc | Fake CVE-2023 Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 167a842b97d0434f20e0cd6cf73d07079255a743d26606b94fc785a0f3c6736e | 9c55efa171 april 27 updated party list.zip 123.253.35[.]231 167a842b97d0434f20e0cd6cf73d07079255a743d26606b94fc785a0f3c6736e notice re uec, (04-25-2023 day).zip 123.253.35[.]231 4fbfbf | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 243b92959cd9aa03482f3398fbe81b4874c50a5945fe6b0c0abb432a33db853f | 2a8fcfc58c18f53773411f41824b7f6c2675c1d531ffa109dc4f842119b 243b92959cd9aa03482f3398fbe81b4874c50a5945fe6b0c0abb432a33db853f a0887fa90f88dd002b025a97b3a57e4fdb7f5fdd725490d96776f8626f5 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2a00d95b658e11ca71a8de532999dd33ddee7f80432653427eaa885b611ddd87 | load a malicious payload with a filename of BrMod104.dll ( 2a00d95b658e11ca71a8de532999dd33ddee7f80432653427eaa885b611ddd87 ). This malicious payload is a variant of PubLoad, which is | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2bae8b07f5098e1ca8fb5a5776eb874072ace4e19734cba4af4450eeccde7f89 | 831368e6420b90210e15f72cea9171478391e15efdd608ad22fe916cea8 2bae8b07f5098e1ca8fb5a5776eb874072ace4e19734cba4af4450eeccde7f89 a229a2943cf8d1b073574f0c050ca06392d0525b2028f4b4b04d1e4b401 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3cef0b5f069cc1d15d36aa83d54d2a7be79b29b02081b6592dd4714639ad0a66 | f1dbe6a82488db161a7f57cd74f2dd282a9522587f18313b4e9835dc558 3cef0b5f069cc1d15d36aa83d54d2a7be79b29b02081b6592dd4714639ad0a66 43de1831368e6420b90210e15f72cea9171478391e15efdd608ad22fe91 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3e137da41cb509412ee230c6d7aac3d69361358b28c3a09ec851d3c0f3853326 | 456eb3a1a51116d9c2991aae3b0982acc1a9b30efee92a4f102dc4d2927 3e137da41cb509412ee230c6d7aac3d69361358b28c3a09ec851d3c0f3853326 fdad627a21a95ea2a6136c264c6a6cc2f0910a24881118b6eabc2d6509d | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 41276827827b95c9b5a9fbd198b7cff2aef6f90f2b2b3ea84fadb69c55efa171 | 8 analysis of the third meeting of ndsc.zip 123.253.32[.]15 41276827827b95c9b5a9fbd198b7cff2aef6f90f2b2b3ea84fadb69c55efa171 april 27 updated party list.zip 123.253.35[.]231 167a842b97 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 43de1831368e6420b90210e15f72cea9171478391e15efdd608ad22fe916cea8 | b5f069cc1d15d36aa83d54d2a7be79b29b02081b6592dd4714639ad0a66 43de1831368e6420b90210e15f72cea9171478391e15efdd608ad22fe916cea8 2bae8b07f5098e1ca8fb5a5776eb874072ace4e19734cba4af4450eeccd | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4a92fa725adc57d7b501f33e87230a8291cf8ad22d4d3a830293abcc0ac10d12 | 1c1ab42186a46e08b914d66253440af2d2be6b497c34fe4b1770c3b5e01 4a92fa725adc57d7b501f33e87230a8291cf8ad22d4d3a830293abcc0ac10d12 da8ef50fe5e571d0143a758c7c66bb55653f1f2d04f16464fc857226441 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4fbfbf1cd2efaef1906f0bd2195281b77619b9948e829b4d53bf1f198ba81dc5 | c6736e notice re uec, (04-25-2023 day).zip 123.253.35[.]231 4fbfbf1cd2efaef1906f0bd2195281b77619b9948e829b4d53bf1f198ba81dc5 biography of… | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5064b2a8fcfc58c18f53773411f41824b7f6c2675c1d531ffa109dc4f842119b | sktop\uuid\uu\Release\uu.pdb www.fjke5oe[.]com Nov. 9, 2022 5064b2a8fcfc58c18f53773411f41824b7f6c2675c1d531ffa109dc4f842119b ltdis13n.dll E:\WhiteFile\LTDIS13n\Release\LTDIS13n.pdb www | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 51bf329ba04a042789bad3b395092488a3d89130dc72818985cde11fb85f8389 | 9a82715b4d3b6c37c7e5be1b729cd8e6f01f feareade HTTP.dll 0x13 51bf329ba04a042789bad3b395092488a3d89130dc72818985cde11fb85f8389 fdafgravfdrafra WinINetwork.dll 0x17 Table 3. Contemporary | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6804b10aefe8fdb2b33ecf3bc5a93f49413ef66001b561e6fc121990d703d780 | 0b36bbd128a71ddcd858b4b3c67ba78f516 Coder.dll Coder.dll 0xA 6804b10aefe8fdb2b33ecf3bc5a93f49413ef66001b561e6fc121990d703d780 999999.000 Digest.dll 0xB 72aa72a4a4bdb09146c587304c6639eae | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 72aa72a4a4bdb09146c587304c6639eae65900cb2ea26911540a77d1f9b7acf6 | 9413ef66001b561e6fc121990d703d780 999999.000 Digest.dll 0xB 72aa72a4a4bdb09146c587304c6639eae65900cb2ea26911540a77d1f9b7acf6 AES.dll AES.dll 0xC fb25a69ffc18b79ee664462e0717cf5e7082094 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9192a1c1ab42186a46e08b914d66253440af2d2be6b497c34fe4b1770c3b5e01 | 2943cf8d1b073574f0c050ca06392d0525b2028f4b4b04d1e4b40110c66 9192a1c1ab42186a46e08b914d66253440af2d2be6b497c34fe4b1770c3b5e01 4a92fa725adc57d7b501f33e87230a8291cf8ad22d4d3a830293abcc0ac | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.