Indicators of compromise
1,365 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| sha256 | 4f6a9d2c775e0ba38189390aa7975973209f8e703d6f974c2ab67c97ad263204 | ba7d Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mpsl 4f6a9d2c775e0ba38189390aa7975973209f8e703d6f974c2ab67c97ad263204 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.ppc c2640 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 4fe20e73217d0bde39616ebf6f50f0f27882f939537561849f7b17968c5b8e30 | 4f5c25975e Feb 23, 2021 09:03 UTC 185[.]239.242.63/lolol.sh 4fe20e73217d0bde39616ebf6f50f0f27882f939537561849f7b17968c5b8e30 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.mpsl 6b1be | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 515dc2fd8819c7fc82395acc4c7fb5b2903982a5f48bc26bc8d0235bc0664d1f | c07c8ec Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm6 515dc2fd8819c7fc82395acc4c7fb5b2903982a5f48bc26bc8d0235bc0664d1f Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm7 a9c4ea4 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 519b2d04e80c2cb7c000a3c00cb30098df363bd825281b2b7384d964b832df3b | be23 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm7 519b2d04e80c2cb7c000a3c00cb30098df363bd825281b2b7384d964b832df3b Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm6 7a57 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 528179f34ed9a6e69f582c23b3cbb50343164bf0e5995624a8d16f8b0df202e8 | 6b1287 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.sh4 528179f34ed9a6e69f582c23b3cbb50343164bf0e5995624a8d16f8b0df202e8 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.x86 f05d21 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 5446350c771766589e6d79e8185e10fcc0a6681eb76723b7f26dfef03c9080a5 | 8e8f Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.ppc 5446350c771766589e6d79e8185e10fcc0a6681eb76723b7f26dfef03c9080a5 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.sh4 02f0 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 5525b282df49206e76e884ca0f86806ddc97ec08343bab1d9a98f029a2697b08 | 97521 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm 5525b282df49206e76e884ca0f86806ddc97ec08343bab1d9a98f029a2697b08 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm5 b82b | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 554bee9f896a7a013804485894875348ff760b08ff7b0ae14c210e2b37da75f6 | 542b5 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.sh4 554bee9f896a7a013804485894875348ff760b08ff7b0ae14c210e2b37da75f6 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.x86 2a097 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 5715d9c632c646c856f2775de8e98c00cade29f7bfb6fbe33a5741b01e897521 | c804b97c2d Feb 24, 2021 15:59 UTC 185[.]239.242.63/lolol.sh 5715d9c632c646c856f2775de8e98c00cade29f7bfb6fbe33a5741b01e897521 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm 5525b | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 5d7487a5d6febb015a21a98eddffc617cfc06453fe2a7dacac6e1719f56c56fb | 4a13 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm5 5d7487a5d6febb015a21a98eddffc617cfc06453fe2a7dacac6e1719f56c56fb Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mpsl e9d0 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 60135a7817a0a1734c2e211a8613873548f4611fddc8666890f6a69860c43e61 | A256 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.arm5 60135a7817a0a1734c2e211a8613873548f4611fddc8666890f6a69860c43e61 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.arm6 087f | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 63e66d6f0ddf5fea5b1f71643bdb30f3fff4531c364b6fd1b0e0e0cfe5da833f | fbe004b8 Mar 5, 2021 14:13 UTC 45[.]133.1.133/bins/dark.ppc 63e66d6f0ddf5fea5b1f71643bdb30f3fff4531c364b6fd1b0e0e0cfe5da833f Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.m68k 0a664a7 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 64f9bc6e925fd2f538c89fd8a8c25d11521b9fcc51c8c5308e9850c990bea04b | 2ff4f Mar 11, 2021 13:12 UTC 203[.]159.80.241/bins/dark.x86 64f9bc6e925fd2f538c89fd8a8c25d11521b9fcc51c8c5308e9850c990bea04b Mar 11, 2021 12:59 UTC 203[.]159.80.241/bins/dark.ppc 0c4ec | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 667640d293e4ce2287546fc2e0056ee14f414868bf5b77f72078096c516a9fb0 | eac4 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mpsl 667640d293e4ce2287546fc2e0056ee14f414868bf5b77f72078096c516a9fb0 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.ppc beb0b | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 66ea76a427b69f153486f962baff29d4a68393e985c7d88c94d773b25ad4964a | 0302 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.m68k 66ea76a427b69f153486f962baff29d4a68393e985c7d88c94d773b25ad4964a Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mips def1 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 6a68acd757fab908b2455c9b5882c25ab4a550121c2badb960b0a514a04a8d3d | e30 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/combo.txt 6a68acd757fab908b2455c9b5882c25ab4a550121c2badb960b0a514a04a8d3d Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.386 ba | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 6b1bea5f17eb2c16815b8cb87d6e24e707248e5384fc4dd33c86c189657c73ff | b8e30 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.mpsl 6b1bea5f17eb2c16815b8cb87d6e24e707248e5384fc4dd33c86c189657c73ff Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.ppc 918395 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 73aaf3ce3e5ea7a598f01d727e8278ff64ff0067fc2f2b22387b09de64c2ff4f | efb8 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mips 73aaf3ce3e5ea7a598f01d727e8278ff64ff0067fc2f2b22387b09de64c2ff4f Mar 11, 2021 13:12 UTC 203[.]159.80.241/bins/dark.x86 64f9b | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 73b35ddbf9784a6f6ebad7f5a1f4965daedc2f92cbb45a9cb76e61c0104bf553 | 10dd6 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.sh4 73b35ddbf9784a6f6ebad7f5a1f4965daedc2f92cbb45a9cb76e61c0104bf553 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.x86 a925f | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 74ab77e1069c6fb32925e89563c57f09c842cad0de6ab6b7c9ec2fa44d2641b1 | 6854 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.mips 74ab77e1069c6fb32925e89563c57f09c842cad0de6ab6b7c9ec2fa44d2641b1 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.mpsl 0039 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 77a1f62dc76cc9ee2d924008a0fdcc329396021f027ebe1cfa468f9625c2455b | db5ff Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.sh4 77a1f62dc76cc9ee2d924008a0fdcc329396021f027ebe1cfa468f9625c2455b Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.x86 8d116 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 7a571f666c8f272cce1ee7ad75520a013bbed800e7d0c80a17804500a3474a13 | df3b Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm6 7a571f666c8f272cce1ee7ad75520a013bbed800e7d0c80a17804500a3474a13 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm5 5d74 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 7aa437a562f3a956cf60fce652e6a0fb2d3c7cda0e5312c1a7fa62e177c45906 | 16629 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.sh4 7aa437a562f3a956cf60fce652e6a0fb2d3c7cda0e5312c1a7fa62e177c45906 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.x86 8e65d | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 80cd13bfcc2fc29096abf18525d17766700a6d25a9806e55c7b7de776cba0302 | 2f47 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm7 80cd13bfcc2fc29096abf18525d17766700a6d25a9806e55c7b7de776cba0302 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.m68k 66ea | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 8524826a687491c6bfd161df3e4fb2f537f50ea32834d7710dcf3b788a5ddfc2 | Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.amd64 8524826a687491c6bfd161df3e4fb2f537f50ea32834d7710dcf3b788a5ddfc2 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.arm 4f | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 85acead88180809d47524aac87d6f76799e7c0a1729d9614446be73aa8e7d871 | f1c9 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.mpsl 85acead88180809d47524aac87d6f76799e7c0a1729d9614446be73aa8e7d871 Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.ppc 0bbdb | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 8cc6375f2eabe865e8400f27381a513a69e4100748458c3d2c706f3d4002bf1e | 31cf Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm5 8cc6375f2eabe865e8400f27381a513a69e4100748458c3d2c706f3d4002bf1e Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm6 4414 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 8d0beb4b143dc4a9543b4bc5d7f44a6771a973709aaf8c3a4754d120b99d0afd | 5537 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm7 8d0beb4b143dc4a9543b4bc5d7f44a6771a973709aaf8c3a4754d120b99d0afd Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.m68k f977 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 8d11635019b077d36ce7de2a3ca9261f126e0ff5808f722fcb967e7cd000be23 | 2455b Mar 13, 2021 02:43 UTC 203[.]159.80.241/bins/dark.x86 8d11635019b077d36ce7de2a3ca9261f126e0ff5808f722fcb967e7cd000be23 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.arm7 519b | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 8e65d7b16939834e1cd86b36b495924d34f10a8c477b53c9c8e648c804b97c2d | 45906 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.x86 8e65d7b16939834e1cd86b36b495924d34f10a8c477b53c9c8e648c804b97c2d Feb 24, 2021 15:59 UTC 185[.]239.242.63/lolol.sh 5715d9c632 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 904b086dbf3e8f4dd1711d758d54675ce2d6002ff607a72d72d7e3aea612ba7d | b7e7 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mips 904b086dbf3e8f4dd1711d758d54675ce2d6002ff607a72d72d7e3aea612ba7d Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mpsl 4f6a | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 918395bac079ab747736246b9d84e66921774d3eb95bb47045704624646b1287 | 7c73ff Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.ppc 918395bac079ab747736246b9d84e66921774d3eb95bb47045704624646b1287 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.sh4 528179 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 971b5a96d84ca0d7dd906b639cd97a04835013be32356d09037cff64516c73bf | 962cbc2b Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.ppc 971b5a96d84ca0d7dd906b639cd97a04835013be32356d09037cff64516c73bf Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.sh4 e2a6ac51 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 9aa0ded21b8c21075a6ad24180befc47dbfeb3985a433f1baa6181ec945a19b9 | a74093e2 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.x86 9aa0ded21b8c21075a6ad24180befc47dbfeb3985a433f1baa6181ec945a19b9 Mar 3, 2021 14:24 UTC 45[.]133.1.133/lolol.sh ecae298b18493 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 9d55aa1d9841be74cdc0c9d0a9fe2f20e0704ea30c721a7b2dcae02675416629 | 50f7c Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.ppc 9d55aa1d9841be74cdc0c9d0a9fe2f20e0704ea30c721a7b2dcae02675416629 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.sh4 7aa43 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | a447bb67be310702807ff148f53f2b4c64ddba0c37f92caf6acabdfaa9ad6603 | 37ca Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm5 a447bb67be310702807ff148f53f2b4c64ddba0c37f92caf6acabdfaa9ad6603 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm6 b212 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | a5c2b758da21d7895c7945de8684c9b27370af6c5bf48ce3d94626261982659f | 5 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.mips a5c2b758da21d7895c7945de8684c9b27370af6c5bf48ce3d94626261982659f Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.mipsle | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | a5ca43106a713c4a8e978575b8685889c244501288b9fa7c7dc7f1e8c5ef1291 | a7a641a2 Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.x86 a5ca43106a713c4a8e978575b8685889c244501288b9fa7c7dc7f1e8c5ef1291 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.m68k a6cb635 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | a6cb6356432ca83467f6da2168be2aabbabe5d2f2dd4c01d6c4a93d01a57df53 | 5ef1291 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.m68k a6cb6356432ca83467f6da2168be2aabbabe5d2f2dd4c01d6c4a93d01a57df53 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.sh4 c686712f | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | a925f0486b33f3f05d610d33c5a4b6bb2d5531c89e804e001ec01c4f5c25975e | bf553 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.x86 a925f0486b33f3f05d610d33c5a4b6bb2d5531c89e804e001ec01c4f5c25975e Feb 23, 2021 09:03 UTC 185[.]239.242.63/lolol.sh 4fe20e7321 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | a9c4ea40b08ce4281c2dc9776355186dfc5649f9ec2b36c32fa5540f8d2aef2d | 0664d1f Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm7 a9c4ea40b08ce4281c2dc9776355186dfc5649f9ec2b36c32fa5540f8d2aef2d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.m68k ac75cb7 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | ac75cb71c2f052141a238b8f7215d5a0956f7034cf90f231d228ce58254d23ba | d2aef2d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.m68k ac75cb71c2f052141a238b8f7215d5a0956f7034cf90f231d228ce58254d23ba Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.mips 1e56f8c | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | b066b1c1d019fc97e3649b99ad10294783b13a12b67d34b9c8500e762c37b7e7 | ed55 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.m68k b066b1c1d019fc97e3649b99ad10294783b13a12b67d34b9c8500e762c37b7e7 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.mips 904b | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | b2122c5a9c738d964fa770760db40d6708de377e2e671feccb836054ceda2f47 | 6603 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm6 b2122c5a9c738d964fa770760db40d6708de377e2e671feccb836054ceda2f47 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm7 80cd | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | b37da8e6afa2b3223b1f8f73e6801cf3fed3c0f114cfb9c134b5f06322a337ca | Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.mipsle b37da8e6afa2b3223b1f8f73e6801cf3fed3c0f114cfb9c134b5f06322a337ca Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.arm5 a447 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | b3a20c8dfa5adaa8247c4d2097f3cc8423b4e270c9735f616628bf9bde583cbe | 2e780a7807a Feb 22, 2021 16:30 UTC 37[.]46.150.102/lolol.sh b3a20c8dfa5adaa8247c4d2097f3cc8423b4e270c9735f616628bf9bde583cbe Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm5 210 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | b82b8957a4397eae1061a74fb7a8014cbbcbe7064d4edf2e0b15233fd2ce8cca | 7b08 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm5 b82b8957a4397eae1061a74fb7a8014cbbcbe7064d4edf2e0b15233fd2ce8cca Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm6 ec9d | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | baedd59eba62c289dcb722588895eb165f4a1570b3c012efc3dcc60d3bdea521 | 3d Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.386 baedd59eba62c289dcb722588895eb165f4a1570b3c012efc3dcc60d3bdea521 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/brute/nbrute.amd64 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | beb0b7178b242f2dba21c3d91abf80e8738847b8086d2a42e9352738c83542b5 | a9fb0 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.ppc beb0b7178b242f2dba21c3d91abf80e8738847b8086d2a42e9352738c83542b5 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.sh4 554be | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | bfd14a2f5c26501efb5d4010839b7d0bbc9a639d86ab5d12af663de598f15427 | 98f Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm6 bfd14a2f5c26501efb5d4010839b7d0bbc9a639d86ab5d12af663de598f15427 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm7 d9f | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | c26401490ab9343b023f1f89b39d8d32835a795117ef7d7a129871bc05010dd6 | 63204 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.ppc c26401490ab9343b023f1f89b39d8d32835a795117ef7d7a129871bc05010dd6 Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.sh4 73b35 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | c686712f9be64e3d2957754ce181e5b4680b205cb6773b85b35df57983ed31cf | 1a57df53 Feb 26, 2021 13:14 UTC iotlmao[.]xyz/bins/dark.sh4 c686712f9be64e3d2957754ce181e5b4680b205cb6773b85b35df57983ed31cf Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.arm5 8cc6 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | cc996d19c3e9b732b5f61fb7a2ad20a4f9e1fd7e62f484f15c7cc984a32dec01 | 1d26c63 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.mpsl cc996d19c3e9b732b5f61fb7a2ad20a4f9e1fd7e62f484f15c7cc984a32dec01 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.sh4 f05225fe | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | cd59c912b9af910db1880d6fb86cd6cb656477552cf2c2fc82e372bafbe004b8 | ca51 Mar 11, 2021 12:30 UTC 203[.]159.80.241/bins/dark.m68k cd59c912b9af910db1880d6fb86cd6cb656477552cf2c2fc82e372bafbe004b8 Mar 5, 2021 14:13 UTC 45[.]133.1.133/bins/dark.ppc 63e66d6f | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | d31f1fecde01cc37950dc5b5330cd72e8ab1943f251bdfa5990f0d9d3a0a8e8f | 3b2 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.mpsl d31f1fecde01cc37950dc5b5330cd72e8ab1943f251bdfa5990f0d9d3a0a8e8f Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.ppc 5446 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | d9f7504b3fe81f5264da5f23bdb7529f6d1dd713e28a92828180787729872a8d | 427 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.arm7 d9f7504b3fe81f5264da5f23bdb7529f6d1dd713e28a92828180787729872a8d Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.m68k 408 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | def1959fae2d8a3dfe606126ceb9d5403deae97a4b4e216dc8e60354980eeac4 | 964a Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mips def1959fae2d8a3dfe606126ceb9d5403deae97a4b4e216dc8e60354980eeac4 Feb 16, 2021, 11:01 UTC 37[.]46.150.102/bins/dark.mpsl 6676 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | e2a6ac516ec8b5dcc76becc26cf992434882d490d8f2c9d7071298dba7a641a2 | 516c73bf Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.sh4 e2a6ac516ec8b5dcc76becc26cf992434882d490d8f2c9d7071298dba7a641a2 Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.x86 a5ca4310 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | e9d056afe12210ddf98967e3291127ef9d0d24cbd36862ebc8b0726a565eefb8 | 56fb Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mpsl e9d056afe12210ddf98967e3291127ef9d0d24cbd36862ebc8b0726a565eefb8 Mar 11, 2021 19:22 UTC 203[.]159.80.241/bins/dark.mips 73aa | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | ec9dc19758ba74fb254c69d2b60ae1012b1bd65390e936990e4bd8573bcb83aa | 8cca Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm6 ec9dc19758ba74fb254c69d2b60ae1012b1bd65390e936990e4bd8573bcb83aa Feb 23, 2021 09:03 UTC 185[.]239.242.63/bins/dark.arm7 38d8 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | ecae298b18493bf2366f6081e8215a474cce4554e07a7b2380a7f8e8a3a9a37d | 181ec945a19b9 Mar 3, 2021 14:24 UTC 45[.]133.1.133/lolol.sh ecae298b18493bf2366f6081e8215a474cce4554e07a7b2380a7f8e8a3a9a37d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm5 fb940b1 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | f05225fec1fda7c6405e6961207ee12e198272d352144f516e970829a74093e2 | a32dec01 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.sh4 f05225fec1fda7c6405e6961207ee12e198272d352144f516e970829a74093e2 Mar 4, 2021 10:19 UTC 45[.]133.1.133/bins/dark.x86 9aa0ded2 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | f05d21a5b4b72a761c1540f1400dff7e39f10ac1c8b843ec8986d2e780a7807a | f202e8 Feb 22, 2021 16:30 UTC 37[.]46.150.102/bins/dark.x86 f05d21a5b4b72a761c1540f1400dff7e39f10ac1c8b843ec8986d2e780a7807a Feb 22, 2021 16:30 UTC 37[.]46.150.102/lolol.sh b3a20c8dfa5 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | f467e6335a4a0250a17d61b3d138b31998f3e6669e1fcd1c3648db1b44b55ffa | 01e6 Feb 22, 2021, 12:32 UTC 185[.]239.242.63/bins/dark.x86 f467e6335a4a0250a17d61b3d138b31998f3e6669e1fcd1c3648db1b44b55ffa Feb 22, 2021, 12:32 UTC 185[.]239.242.63/lolol.sh 4fe20e732 | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | f9770197d2254e6d5d4cb872b07dc25feb2994d4d5f0b3c854a98f9dfa3c6854 | 0afd Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.m68k f9770197d2254e6d5d4cb872b07dc25feb2994d4d5f0b3c854a98f9dfa3c6854 Feb 24, 2021 15:59 UTC 185[.]239.242.63/bins/dark.mips 74ab | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | fb940b1049e0e95c03adb7a2750347108cadf6b19ef4149a5103f7625c07c8ec | 3a9a37d Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm5 fb940b1049e0e95c03adb7a2750347108cadf6b19ef4149a5103f7625c07c8ec Mar 3, 2021 14:24 UTC 45[.]133.1.133/bins/dark.arm6 515dc2f | New Mirai Variant Targeting Network Security Devices Palo Alto Unit 42 | · 29d ago |
| sha256 | 2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a | Windows executable file for FrostyGoop malware SHA256 hash: 2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a File size: 3.4 MB (3,359,232 bytes) File type: PE32+ execut | FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications Palo Alto Unit 42 | · 29d ago |
| sha256 | 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb | he two FrostyGoop samples have the following SHA256 hashes: 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fe | FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications Palo Alto Unit 42 | · 29d ago |
| sha256 | a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c | fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c The task_test.json configuration file only has a function c | FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications Palo Alto Unit 42 | · 29d ago |
| sha256 | 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d | 6 The first TuxBot sample appears on VirusTotal SHA256 hash 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d , x86_64 debug build with symbols March 5, 2026 C2 server f | TuxBot v3: Inside an IoT Botnet Framework With LLM Palo Alto Unit 42 | · 29d ago |
| sha256 | 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc | l JenX sample MD5: fb93601f8d4e0228276edff1c6fe635d SHA256: 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc Updated JenX Sample MD5: f1c099d65bf94e009f5e65238caac468 S | Home & Small Office Wireless Routers Exploited to Attack Gaming Servers Palo Alto Unit 42 | · Aug 18, 2026 |
| sha256 | 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07 | eam uncovered an updated variant of Gafgyt malware (SHA256: 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07 ) derived from JenX variant, and after analyzing the sample | Home & Small Office Wireless Routers Exploited to Attack Gaming Servers Palo Alto Unit 42 | · Aug 18, 2026 |
| sha256 | 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd | 02c2119f62762f78523aa7cbc96ef1 Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4 | Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2 | research blog, we are discussing the following file: SHA256 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2 MD5 79ad2084b057847ce2ec2e48fda64073 Compile Date 2017-12-2 | Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1 | n be seen in the images below: Figure 1 Lure extracted from a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1 Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6 | Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a | 67e92b49169c24051ee9de41327ee5e6ac7c2 BADNEWS SHA256 Hashes ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c92 | Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571 | 6acf5055831cc961a51d3e921f96bd Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571 Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e | Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 | 7e27d2ffa83ca053a87deb7560a571 Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b4 | Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4 | a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4 The payload from each of the malicious documents is an upda | Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0517b62233c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7 | During runtime, the following plugin was identified: SHA256 0517b62233c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7 SHA1 03defdda9397e7536cf39951246483a0339ccd35 MD5 a5164c686 | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855 | ted to this IP address: SHA256 Description Connection to IP 0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855 Loader C2 facebook-apps.com (resolves to 89.46.222.97) c356 | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0 | For the analysis below, we used the following file: SHA256 119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0 SHA1 25ba920cb440b4a1c127c8eb0fb23ee783c9e01a MD5 6fa5bceda | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458 | o 2 / RU SYSTEM Cluster B Case 2: Delivery via HTA Loader - 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458 In this case the attackers sent an HTML Application file (. | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31 | ,helloworld2,sqmAddTostream,DllEntryPoint microsoftfuckedup 6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31 The following actions are performed with the additional fun | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483 | w. Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483 In our research we found at least one attack against a comp | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78 | or that sample. The retrieved plugin was as follows: SHA256 b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78 SHA1 ac3f20ddc2567af0b050c672ecd59dddab1fe55e MD5 7c65565dc | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e | es have additional unique differences: Hash Functions Mutex bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e helloworld helloworld1,helloworld2,sqmAddTostream,DllEntryP | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d | d855 Loader C2 facebook-apps.com (resolves to 89.46.222.97) c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d PLAINTEE Hosted on 89.46.222.97 Digging in further, the mal | RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4 | omise associated with this analysis include: Upatre SHA256: 8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4 Cthonic SHA256: 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01 | Upatre Continued to Evolve with new Anti Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83 | ample configured with the same dot-bit domains. The sample, 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83, was compiled six days after our Upatre sample and delivere | Upatre Continued to Evolve with new Anti Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0 | d0cf85 SHA1 89a7861acb7983ad712ae9206131c96454a1b3d8 SHA256 0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0 Compile Timestamp 2019-01-07 07:13:47 UTC PDB String c:\Use | Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57 | 83bae4 SHA1 d2c161ce52240b61d632607a2262890327d82502 SHA256 ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57 Compile Timestamp 2018-12-06 11:14:45 UTC Table 1 ArtraDown | Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22 | 662a59 SHA1 177837d0fa5bfd274abe79d80a01cfe2374b4cd9 SHA256 f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22 Compile Timestamp 2018-07-30 09:18:37 UTC PDB String d:\C++ | Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff | [.]com/update.php?req=<redacted>&m=d This payload, (SHA256: 0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff), which we are tracking as MechaFlounder, was developed in | New Python-Based Payload MechaFlounder Used by Chafer Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1 | hows a VBScript run by an OilRig delivery document (SHA256: 1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1) on the left compared to a Chafer AutoIT script (SHA256: 33 | New Python-Based Payload MechaFlounder Used by Chafer Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 332fab21cb0f2f50774fccf94fc7ae905a21b37fe66010dcef6b71c140bb7fa1 | e1) on the left compared to a Chafer AutoIT script (SHA256: 332fab21cb0f2f50774fccf94fc7ae905a21b37fe66010dcef6b71c140bb7fa1) on the right, which have colored boxes surrounding code ov | New Python-Based Payload MechaFlounder Used by Chafer Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f | ooter of Activity.doc file is actually an RTF file (SHA256: 5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f ) that loads an embedded Excel document with a heavily obfu | Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946 | document attached with the filename “Activity.doc” (SHA256: d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946 ) that attempted to load a remote OLE document via Template | Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 892d5e8e763073648dfebcfd4c89526989d909d6189826a974f17e2311de8bc4 | soka\\Hisoka\\obj\\Debug\\inetinfo.sys.pdb The file SHA256: 892d5e8e763073648dfebcfd4c89526989d909d6189826a974f17e2311de8bc4 was used in reference to the below analysis on Hisoka v0.8. | xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | eccc65711cbd154f680e8c8ef343d53f29e4a6237510abd4ad1eab5742b035b3 | HY200 DNS Tunneling Protocol We analyzed the file ( SHA256: eccc65711cbd154f680e8c8ef343d53f29e4a6237510abd4ad1eab5742b035b3) in order to understand the capabilities of the payload and | xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection Palo Alto Unit 42 | · Aug 17, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.