Indicators of compromise
4,179 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| sha256 | 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849 | aw./BJlk,yUPjgI`^@$*tumYA'p2RoX=v_:M43" Datper (SHA256: 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849): 1 2 plain text = "KhL9V1ds5Z" QnfNC & Fb8xGr - ( ) &l | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 | 3cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 Datper 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e | 6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb 9002 933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 | ration data in its body. One of the Minzen samples (SHA256: 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2) found in the Republic of Korea in December 2016 installs s | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 | , news.softfix.co[.]kr was the C2 server of Daserf (SHA256: 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423). Another subdomain, bbs.softfix.co[.]kr was hosted on same | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 | 2448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 | e0a1bf423ab7e54b9df361360933bac3bb852a31849 HomamDownloader a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 C2 lywjrea.gmarketshop[.]net krjregh.sacreeflame[.]com psfi | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 | n this report using the UBoatRAT Indicators UBoatRAT SHA256 bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a8 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 | 2e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af0 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 | 9e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f | b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 NamelessHdoor dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda04 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c | 7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 | 7138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff478 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 | a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e | ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e | 66e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d4 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3 | d59085b3d6ab78659efee9f152b310e61d2e7edb5 Downloader SHA256 f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3 Web Access https://raw.githubusercontent[.]com/r1ng/news/ma | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 | fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a499135 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | englandprevail.com | alicious files from the remote C2 server; in this case, pre.englandprevail[.]com. Trojanized Legitimate Software SHA256 Movie Player insta | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e | dca2c2b8dfea34e6f3f723274d88890f6ceb HomamDownloader SHA256 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62b | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8 | 61352ef4f084d969dd30719166b47fdb204828a SysmonLoader SHA256 31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8 Mutex SysMonitor_3A2DCB47 File Path %ProgramFiles%\Windows | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6 | ee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd2 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb | 269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb Table 1 Trojanized Korean programs During our investigation | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a | of this file. Trojanized Legitimate Software SHA256 GO Game 8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a Table 2 Trojanized Japanese language program Despite the di | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78 | 3bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa | rojanized Legitimate Software SHA256 Movie Player installer b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 | 4898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec | 25c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec C2 of HomamDownloader pre.englandprevail[.]com | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | dynssl.com | s by using the HTTP POST method on TCP port 443. kted56erhg.dynssl[.]com euiro8966.organiccrap[.]com These domains are provided by | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | lookin.at | 71e01fb2aa2856f230943460e14e19183a6 XOR YES YES jennifer998.lookin[.]at, 196.44.49[.]154 2014 South Korea 0919-1 dfa1ad6083aa06b8 | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | my-homeip.com | r with the same key “78563412”. It connects to hxxp://games.my-homeip[.]com:443/ks8d[ip address]akspbu.txt by using the HTTP POST met | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | organiccrap.com | T method on TCP port 443. kted56erhg.dynssl[.]com euiro8966.organiccrap[.]com These domains are provided by a free DDNS service and bot | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | tempors.com | 6FC C2: jennifer998.lookin[.]at 196.44.49[.]154 www.hosting.tempors[.]com kted56erhg.dynssl[.]com euiro8966.organiccrap[.]com 116.1 | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0641fe04713fbdad272a6f8e9b44631b7554dfd1e1332a8afa767d845a90b3fa | s shown in Table 3, below. Type PATH SHA256 Dropper EXE N/A 0641fe04713fbdad272a6f8e9b44631b7554dfd1e1332a8afa767d845a90b3fa Bisonal EXE %Temp%\[random].tmp 359835C4A9DBE2D95E483464659 | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 1128d10347dd602ecd3228faa389add11415bf6936e2328101311264547afa75 | 6477a1b120ae44368082f8 Bisonal DLL C:\Windows\Temp\pvcu.dll 1128D10347DD602ECD3228FAA389ADD11415BF6936E2328101311264547AFA75 Russian Decoy PDF C:\Windows\Temp\Комплексный проект по соз | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 359835c4a9dbe2d95e483464659744409e877cb6f5d791daa33fd601a01376fc | fd1e1332a8afa767d845a90b3fa Bisonal EXE %Temp%\[random].tmp 359835C4A9DBE2D95E483464659744409E877CB6F5D791DAA33FD601A01376FC Korean Decoy PDF [dropper path]\[same file name without .ex | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 43459f5117bee7b49f2cee7ce934471e01fb2aa2856f230943460e14e19183a6 | in some original Bisonal samples found in 2012. The sample (43459f5117bee7b49f2cee7ce934471e01fb2aa2856f230943460e14e19183a6) contains the marker string “bisonal” which is the origin o | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8 | n below and executes them. Type PATH SHA256 Dropper EXE N/A b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8 Bisonal DLL C:\Windows\Temp\pvcu.dll 1128D10347DD602ECD3228 | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b2b764597d097fcb93c5b11cbd864ab1bcb894a2a1e2d2de1c469880f612431c | Decoy PDF [dropper path]\[same file name without .exe].pdf B2B764597D097FCB93C5B11CBD864AB1BCB894A2A1E2D2DE1C469880F612431C Table 3, File hashes and system installation paths targetin | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dfa1ad6083aa06b82edfa672925bb78c16d4e8cb2510cbe18ea1cf598e7f2722 | he decoy PDF file of another sample of the Bisonal variant (dfa1ad6083aa06b82edfa672925bb78c16d4e8cb2510cbe18ea1cf598e7f2722) submitted to an online malware database in September 2014. | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f431e0bed6b4b7ffef5e40b1b4b7078f2538f2b2db2869d831de5d7df26ee6cd | лищно-строительных кооперативов для работников оборонки.pdf F431E0BED6B4B7FFEF5E40B1B4B7078F2538F2B2DB2869D831DE5D7DF26EE6CD Table 1. File hashes and paths targeting Russia The dropper | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| url | http://games.my-homeip[ | the RC4 cipher with the same key “78563412”. It connects to hxxp://games.my-homeip[.]com:443/ks8d[ip address]akspbu.txt by using the HTTP POST | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | jma-go.jp | n Smoke Loader contains the following hardcoded C2 address. jma-go[.]jp/js/metrology/jma.php An outline of initial C2 communicati | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | mountainhigh.at | 5e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | racemodel.at | ae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | sungmap.at | re yet. Following is the sample list. Domain Marcher SHA256 Sungmap[.]at 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | thunderbolt-price.com | . The attacker distributes those files from following URLs. thunderbolt-price[.]com/Art-and-Jakes/Coupon.scr bite-me.wz[.]cz/1.exe thunderbol | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | wz.cz | s. thunderbolt-price[.]com/Art-and-Jakes/Coupon.scr bite-me.wz[.]cz/1.exe thunderbolt-price[.]com was registered in 2012 in J | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | 41ee612602833345fc5bd2b98103811c | hash value of the string, MD5("Test_PC0B0D040612345678") = 41EE612602833345FC5BD2B98103811C It then appends the volume serial to the hash value and get | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha1 | 41ee612602833345fc5bd2b98103811c12345678 | ique ID. "41EE612602833345FC5BD2B98103811C" + "12345678" = "41EE612602833345FC5BD2B98103811C12345678" Next, Smoke Loader generates two strings based on the firs | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 | b36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b6 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 | wing is the sample list. Domain Marcher SHA256 Sungmap[.]at 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 27aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633b | c38d022e2b2d7bb7f8f9800b534b60183c Nov 8, 2018 Smoke Loader 27aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633b Nov 9, 2018 Smoke Loader 42fdaffdbacfdf85945bd0e8bfaadb765d | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f415 | 2018 Registers jma-go[.]jp domain Nov 5, 2018 Smoke Loader 3d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f415 Nov 6, 2018 Smoke Loader 8a1aab36c3940e4dd83f489432fa710fba | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 42fdaffdbacfdf85945bd0e8bfaadb765dde622a0a7268f8aa70cd18c91a0e85 | 77ec346af050ffd90a43b8dcd528c9633b Nov 9, 2018 Smoke Loader 42fdaffdbacfdf85945bd0e8bfaadb765dde622a0a7268f8aa70cd18c91a0e85 Nov 15, 2018 Smoke Loader fb3def9c23ba81f85aae0f563f4156ba9 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50dddbda8 | c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a07970347815d9c50dddbda8 Table 3 Domains and Marcher hashes On November 25, we confi | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 70900b5777ea48f4c635f78b597605e9bdbbee469b3052f1bd0088a1d18f85d3 | 4156ba9453c2e928728283de4abdfb5b5f426f Nov 24, 2018 AzoRult 70900b5777ea48f4c635f78b597605e9bdbbee469b3052f1bd0088a1d18f85d3 Nov 25, 2018 Smoke Loadera 1ce72ec2f2fe6139eb6bb35b8a4fb40a | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7337143e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 | a4fb40aca2d90bc19872d6517a6ebb66b6b139 Nov 27, 2018 AzoRult 7337143e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 Nov 30, 2018 Changes the IP address associates with jma-go[ | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 748c94bfdb94b322c876114fcf55a6043f1cd612766e8af1635218a747f45fb9 | 43e5fb7ecbdf1911e248d73c930a81100206e8813ad3a90d4dd69ee53c7 748c94bfdb94b322c876114fcf55a6043f1cd612766e8af1635218a747f45fb9 Marcher Samples 55ae2b00234674d82dcc401a0daa97e7b3921057a07 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a | cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772f12c4fc64292a32a96fde7a Racemodel[.]at 55ae2b00234674d82dcc401a0daa97e7b3921057a079 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8a1aab36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d | 591efe5aefd379205e5cc3af574bb9f415 Nov 6, 2018 Smoke Loader 8a1aab36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc2 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a1ce72ec2f2fe6139eb6bb35b8a4fb40aca2d90bc19872d6517a6ebb66b6b139 | f9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f a1ce72ec2f2fe6139eb6bb35b8a4fb40aca2d90bc19872d6517a6ebb66b6b139 AzoRult Samples 70900b5777ea48f4c635f78b597605e9bdbbee469b3 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b60183c | d1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b60183c Nov 8, 2018 Smoke Loader 27aa9cdf60f1fbff84ede0d77bd49677ec | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fb3def9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f | 65dde622a0a7268f8aa70cd18c91a0e85 Nov 15, 2018 Smoke Loader fb3def9c23ba81f85aae0f563f4156ba9453c2e928728283de4abdfb5b5f426f Nov 24, 2018 AzoRult 70900b5777ea48f4c635f78b597605e9bdbbee | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | beta.officopedia.com | rvice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]br | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | blogsite.org | 1f5a9b2d59b08500882563011d1def2b8d0b1b9bbb8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]win | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | check.homeip.net | n[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net o | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | check.webhop.org | dns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt Strike Beacon contai | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | cortana.homelinux.com | 0882563011d1def2b8d0b1b9bbb8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortana | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | cortanasyn.com | from the following remote location and executes it: https://cortanasyn[.]com/Avcv The fourth shellcode loads the embedded Cobalt Strik | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | cortanazone.com | .]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.] | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | e.browsersyn.com | .]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com che | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | mail.fptservice.net | te[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.] | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | office.windown-update.com | .]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyn | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | outlook.updateoffices.net | s[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail[.]fptservice[.]net office[.]windown-update[.]com c | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | ristineho.com | erveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt Strike Beacon contains the hard-coded | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | servebbs.com | machine. OS A rchitecture URL User Agent 32 bit https://syn.servebbs[.]com/kuss32.gif Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:6 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | service.serveftp.org | nazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | service.windown-update.com | cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net outlook[.]updateoffices[.]net mail | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | syn.browserstime.com | opedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check[.]webhop[.]org ristineho[.]com Appendix A: Cobalt | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | syn.servebbs.com | .]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.]com service[.]windown-update[.]com check[.]homeip[.]net out | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | videos.dyndns.org | own-update[.]com cortanazone[.]com beta[.]officopedia[.]com videos[.]dyndns[.]org service[.]serveftp[.]org syn[.]browserstime[.]com check | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | word.webhop.info | b8ae C2: theme[[.]]blogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browser | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | work.windownoffice.com | ogsite[.]org cortana[.]homelinux[.]com word[.]webhop[.]info work[.]windownoffice[.]com cortanasyn[.]com e[.]browsersyn[.]com syn[.]servebbs[.] | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 040abac56542a2e0f384adf37c8f95b2b6e6ce3a0ff969e3c1d572e6b4053ff3 | nique through a legitimate program. The RAR archive (SHA256:040abac56542a2e0f384adf37c8f95b2b6e6ce3a0ff969e3c1d572e6b4053ff3) has the Vietnamese file name ‘Don khieu nai.rar’ which tra | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4321a9f95901a77b4acfbaef3596cf681712345e1cbd764873c6643fe9da7331 | 926b73a6a5bc71d655c8d611b40e80464da9f1134bfce7b930e23e273ab 4321a9f95901a77b4acfbaef3596cf681712345e1cbd764873c6643fe9da7331 KerrDown DLLs: 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c345 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b | baef3596cf681712345e1cbd764873c6643fe9da7331 KerrDown DLLs: 4a0309d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be | 9d8043e8acd7cb5c7cfca95223afe9c15a1c34578643b49ded4b786506b 4b431af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b53 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b | af677041dae3c988fcc901ac8ec6e74c6e1467787bf099c4abd658be5be 4bc00f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc | f7d638e042da764e8648c03c0db46700599dd4f08d117e3e9e8b538519b 4e2f8f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce | f104e6cd07508c5b7d49737a1db5eeba910adfdb4c19442a7699dc78cfc 4e791f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 | f2511c9bd3c63c8e37aa6625d8b590054de9e1cca13a7be2630bc2af9ce 539e8a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077e | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d | a53db3f858914cfe0d2132f11de34a691391ba71673a8b1e61367a963c7 53cd92f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f1 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c | 2f37ffd0822cc644717363ba239d75c6d9af0fa305339eaf34077edd22d 53efaac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 | ac9244c24fab58216a907783748d48cb32dbdc2f1f6fb672bd49f12be4c 5c18c3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 | 3e6f7ac0d0ac2b5fa9a6435ee90d6bd77995f85bed9e948097891d42ca2 5cda7d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a6 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e | d8294a8804d09108359dd2d96cdf4fdcf22ec9c00f0182d005afff76743 5f0db8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd | 8216314da1f128b883b918e5ac722202a2ae0c4d0bf1c5da5914a66778e 6010d44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 | 44cdca58cdec4559040e08798e7b28b9434bda940da0a670c93c84e33cd 60b65ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282c | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cd7349 | ebb921dca4762aef427181775d10bbffc30617d777102762ab7913a5aa1 6146aedfe47597606fb4b05458ec4b99d4e1042da7dc974fa33a57e282cd7349 6245b74b1cc830ed95cb630192c704da66600b90a331d9e6db70210acb6 | Tracking OceanLotus’ new Downloader, KerrDown Palo Alto Unit 42 | · Aug 17, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.