ZeroHour

Indicators of compromise

4,179 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use

TypeIndicatorContextArticleFirst seen
sha2567d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849aw./BJlk,yUPjgI`^@$*tumYA'p2RoX=v_:M43" Datper (SHA256: 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849): 1 2 plain text = "KhL9V1ds5Z" QnfNC & Fb8xGr - ( ) &l“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha2568e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f403cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 Datper 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha256933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb 9002 933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha2569374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2ration data in its body. One of the Minzen samples (SHA256: 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2) found in the Republic of Korea in December 2016 installs s“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha2569c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423, news.softfix.co[.]kr was the C2 server of Daserf (SHA256: 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423). Another subdomain, bbs.softfix.co[.]kr was hosted on same“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha2569db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea822448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595UBoatRAT Navigates East Asia
Palo Alto Unit 42
· Aug 17, 2026
sha256a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7e0a1bf423ab7e54b9df361360933bac3bb852a31849 HomamDownloader a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 C2 lywjrea.gmarketshop[.]net krjregh.sacreeflame[.]com psfi“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha256bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271n this report using the UBoatRAT Indicators UBoatRAT SHA256 bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a8UBoatRAT Navigates East Asia
Palo Alto Unit 42
· Aug 17, 2026
sha256ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b9742e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af0“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha256cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb79e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbdUBoatRAT Navigates East Asia
Palo Alto Unit 42
· Aug 17, 2026
sha256dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636fb975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 NamelessHdoor dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda04“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha256e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha256e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb4947138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff478UBoatRAT Navigates East Asia
Palo Alto Unit 42
· Aug 17, 2026
sha256e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha256e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127eccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
sha256eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e66e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d4UBoatRAT Navigates East Asia
Palo Alto Unit 42
· Aug 17, 2026
sha256f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3d59085b3d6ab78659efee9f152b310e61d2e7edb5 Downloader SHA256 f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3 Web Access https://raw.githubusercontent[.]com/r1ng/news/maUBoatRAT Navigates East Asia
Palo Alto Unit 42
· Aug 17, 2026
sha256f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a499135“Tick” Group Continues Attacks
Palo Alto Unit 42
· Aug 17, 2026
domainenglandprevail.comalicious files from the remote C2 server; in this case, pre.englandprevail[.]com. Trojanized Legitimate Software SHA256 Movie Player instaTick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha256019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116edca2c2b8dfea34e6f3f723274d88890f6ceb HomamDownloader SHA256 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bTick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha25631aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e861352ef4f084d969dd30719166b47fdb204828a SysmonLoader SHA256 31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8 Mutex SysMonitor_3A2DCB47 File Path %ProgramFiles%\WindowsTick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha2563227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6ee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd2Tick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha25633665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb Table 1 Trojanized Korean programs During our investigationTick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha2568549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828aof this file. Trojanized Legitimate Software SHA256 GO Game 8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a Table 2 Trojanized Japanese language program Despite the diTick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha25692e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce783bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2Tick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha256b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aarojanized Legitimate Software SHA256 Movie Player installer b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245Tick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha256ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e384898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602Tick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
sha256f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec25c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec C2 of HomamDownloader pre.englandprevail[.]comTick Group Weaponized Secure USB Drives to Target Air
Palo Alto Unit 42
· Aug 17, 2026
domaindynssl.coms by using the HTTP POST method on TCP port 443. kted56erhg.dynssl[.]com euiro8966.organiccrap[.]com These domains are provided byBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
domainlookin.at71e01fb2aa2856f230943460e14e19183a6 XOR YES YES jennifer998.lookin[.]at, 196.44.49[.]154 2014 South Korea 0919-1 dfa1ad6083aa06b8Bisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
domainmy-homeip.comr with the same key “78563412”. It connects to hxxp://games.my-homeip[.]com:443/ks8d[ip address]akspbu.txt by using the HTTP POST metBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
domainorganiccrap.comT method on TCP port 443. kted56erhg.dynssl[.]com euiro8966.organiccrap[.]com These domains are provided by a free DDNS service and botBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
domaintempors.com6FC C2: jennifer998.lookin[.]at 196.44.49[.]154 www.hosting.tempors[.]com kted56erhg.dynssl[.]com euiro8966.organiccrap[.]com 116.1Bisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha2560641fe04713fbdad272a6f8e9b44631b7554dfd1e1332a8afa767d845a90b3fas shown in Table 3, below. Type PATH SHA256 Dropper EXE N/A 0641fe04713fbdad272a6f8e9b44631b7554dfd1e1332a8afa767d845a90b3fa Bisonal EXE %Temp%\[random].tmp 359835C4A9DBE2D95E483464659Bisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha2561128d10347dd602ecd3228faa389add11415bf6936e2328101311264547afa756477a1b120ae44368082f8 Bisonal DLL C:\Windows\Temp\pvcu.dll 1128D10347DD602ECD3228FAA389ADD11415BF6936E2328101311264547AFA75 Russian Decoy PDF C:\Windows\Temp\Комплексный проект по созBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha256359835c4a9dbe2d95e483464659744409e877cb6f5d791daa33fd601a01376fcfd1e1332a8afa767d845a90b3fa Bisonal EXE %Temp%\[random].tmp 359835C4A9DBE2D95E483464659744409E877CB6F5D791DAA33FD601A01376FC Korean Decoy PDF [dropper path]\[same file name without .exBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha25643459f5117bee7b49f2cee7ce934471e01fb2aa2856f230943460e14e19183a6in some original Bisonal samples found in 2012. The sample (43459f5117bee7b49f2cee7ce934471e01fb2aa2856f230943460e14e19183a6) contains the marker string “bisonal” which is the origin oBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha256b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8n below and executes them. Type PATH SHA256 Dropper EXE N/A b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8 Bisonal DLL C:\Windows\Temp\pvcu.dll 1128D10347DD602ECD3228Bisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha256b2b764597d097fcb93c5b11cbd864ab1bcb894a2a1e2d2de1c469880f612431cDecoy PDF [dropper path]\[same file name without .exe].pdf B2B764597D097FCB93C5B11CBD864AB1BCB894A2A1E2D2DE1C469880F612431C Table 3, File hashes and system installation paths targetinBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha256dfa1ad6083aa06b82edfa672925bb78c16d4e8cb2510cbe18ea1cf598e7f2722he decoy PDF file of another sample of the Bisonal variant (dfa1ad6083aa06b82edfa672925bb78c16d4e8cb2510cbe18ea1cf598e7f2722) submitted to an online malware database in September 2014.Bisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
sha256f431e0bed6b4b7ffef5e40b1b4b7078f2538f2b2db2869d831de5d7df26ee6cdлищно-строительных кооперативов для работников оборонки.pdf F431E0BED6B4B7FFEF5E40B1B4B7078F2538F2B2DB2869D831DE5D7DF26EE6CD Table 1. File hashes and paths targeting Russia The dropperBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
urlhttp://games.my-homeip[the RC4 cipher with the same key “78563412”. It connects to hxxp://games.my-homeip[.]com:443/ks8d[ip address]akspbu.txt by using the HTTP POSTBisonal Malware Used in Attacks Against Russia and South Korea
Palo Alto Unit 42
· Aug 17, 2026
domainjma-go.jpn Smoke Loader contains the following hardcoded C2 address. jma-go[.]jp/js/metrology/jma.php An outline of initial C2 communicatiAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
domainmountainhigh.at5e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32aAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
domainracemodel.atae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
domainsungmap.atre yet. Following is the sample list. Domain Marcher SHA256 Sungmap[.]at 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143ebAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
domainthunderbolt-price.com. The attacker distributes those files from following URLs. thunderbolt-price[.]com/Art-and-Jakes/Coupon.scr bite-me.wz[.]cz/1.exe thunderbolAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
domainwz.czs. thunderbolt-price[.]com/Art-and-Jakes/Coupon.scr bite-me.wz[.]cz/1.exe thunderbolt-price[.]com was registered in 2012 in JAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
md541ee612602833345fc5bd2b98103811chash value of the string, MD5("Test_PC0B0D040612345678") = 41EE612602833345FC5BD2B98103811C It then appends the volume serial to the hash value and getAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha141ee612602833345fc5bd2b98103811c12345678ique ID. "41EE612602833345FC5BD2B98103811C" + "12345678" = "41EE612602833345FC5BD2B98103811C12345678" Next, Smoke Loader generates two strings based on the firsAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha2560db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277b36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b6Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha256254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827wing is the sample list. Domain Marcher SHA256 Sungmap[.]at 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha25627aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633bc38d022e2b2d7bb7f8f9800b534b60183c Nov 8, 2018 Smoke Loader 27aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633b Nov 9, 2018 Smoke Loader 42fdaffdbacfdf85945bd0e8bfaadb765dAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha2563d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f4152018 Registers jma-go[.]jp domain Nov 5, 2018 Smoke Loader 3d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f415 Nov 6, 2018 Smoke Loader 8a1aab36c3940e4dd83f489432fa710fbaAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha25642fdaffdbacfdf85945bd0e8bfaadb765dde622a0a7268f8aa70cd18c91a0e8577ec346af050ffd90a43b8dcd528c9633b Nov 9, 2018 Smoke Loader 42fdaffdbacfdf85945bd0e8bfaadb765dde622a0a7268f8aa70cd18c91a0e85 Nov 15, 2018 Smoke Loader fb3def9c23ba81f85aae0f563f4156ba9Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha25655ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50dddbda8c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50dddbda8 Table 3 Domains and Marcher hashes On November 25, we confiAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha25670900b5777ea48f4c635f78b597605e9bdbbee469b3052f1bd0088a1d18f85d34156ba9453c2e928728283de4abdfb5b5f426f Nov 24, 2018 AzoRult 70900b5777ea48f4c635f78b597605e9bdbbee469b3052f1bd0088a1d18f85d3 Nov 25, 2018 Smoke Loadera 1ce72ec2f2fe6139eb6bb35b8a4fb40aAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha2567337143e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7a4fb40aca2d90bc19872d6517a6ebb66b6b139 Nov 27, 2018 AzoRult 7337143e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 Nov 30, 2018 Changes the IP address associates with jma-go[Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha256748c94bfdb94b322c876114fcf55a6043f1cd612766e8af1635218a747f45fb943e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 748c94bfdb94b322c876114fcf55a6043f1cd612766e8af1635218a747f45fb9 Marcher Samples 55ae2b00234674d82dcc401a0daa97e7b3921057a07Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha25675edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7acbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a079Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha2568a1aab36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d591efe5aefd379205e5cc3af574bb9f415 Nov 6, 2018 Smoke Loader 8a1aab36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc2Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha256a1ce72ec2f2fe6139eb6bb35b8a4fb40aca2d90bc19872d6517a6ebb66b6b139f9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f a1ce72ec2f2fe6139eb6bb35b8a4fb40aca2d90bc19872d6517a6ebb66b6b139 AzoRult Samples 70900b5777ea48f4c635f78b597605e9bdbbee469b3Analysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha256be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b60183cd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b60183c Nov 8, 2018 Smoke Loader 27aa9cdf60f1fbff84ede0d77bd49677ecAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
sha256fb3def9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f65dde622a0a7268f8aa70cd18c91a0e85 Nov 15, 2018 Smoke Loader fb3def9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f Nov 24, 2018 AzoRult 70900b5777ea48f4c635f78b597605e9bdbbeeAnalysis of Smoke Loader in New Tsunami Campaign
Palo Alto Unit 42
· Aug 17, 2026
domainbeta.officopedia.comrvice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]brTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainblogsite.org1f5a9b2d59b08500882563011d1def2b8d0b1b9bbb8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]winTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domaincheck.homeip.netn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net oTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domaincheck.webhop.orgdns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt Strike Beacon contaiTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domaincortana.homelinux.com0882563011d1def2b8d0b1b9bbb8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortanaTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domaincortanasyn.comfrom the following remote location and executes it: https://cortanasyn[.]com/Avcv The fourth shellcode loads the embedded Cobalt StrikTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domaincortanazone.com.]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domaine.browsersyn.com.]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com cheTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainmail.fptservice.nette[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainoffice.windown-update.com.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dynTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainoutlook.updateoffices.nets[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com cTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainristineho.comerveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt Strike Beacon contains the hard-codedTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainservebbs.commachine. OS A rchitecture URL User Agent 32 bit https://syn.servebbs[.]com/kuss32.gif Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:6Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainservice.serveftp.orgnazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristinehoTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainservice.windown-update.comcortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mailTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainsyn.browserstime.comopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: CobaltTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainsyn.servebbs.com.]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net outTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainvideos.dyndns.orgown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com checkTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainword.webhop.infob8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browserTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
domainwork.windownoffice.comogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha256040abac56542a2e0f384adf37c8f95b2b6e6ce3a0ff969e3c1d572e6b4053ff3nique through a legitimate program. The RAR archive (SHA256:040abac56542a2e0f384adf37c8f95b2b6e6ce3a0ff969e3c1d572e6b4053ff3) has the Vietnamese file name ‘Don khieu nai.rar’ which traTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2564321a9f95901a77b4acfbaef3596cf681712345e1cbd764873c6643fe9da7331926b73a6a5bc71d655c8d611b40e80464da9f1134bfce7b930e23e273ab 4321a9f95901a77b4acfbaef3596cf681712345e1cbd764873c6643fe9da7331 KerrDown DLLs: 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c345Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2564a0309d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506bbaef3596cf681712345e1cbd764873c6643fe9da7331 KerrDown DLLs: 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2564b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be9d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b53Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2564bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519baf677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dcTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2564e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfcf7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2564e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9cef104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367aTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha256539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077eTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha25653cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22da53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f1Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha25653efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c2f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891dTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2565c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2ac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afffTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2565cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff767433e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a6Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2565f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778ed8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2566010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha25660b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa144cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cTracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026
sha2566146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cd7349ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cd7349 6245b74b1cc830ed95cb630192c704da66600b90a331d9e6db70210acb6Tracking OceanLotus’ new Downloader, KerrDown
Palo Alto Unit 42
· Aug 17, 2026

Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.