Indicators of compromise
1,370 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| sha256 | 9cd895dbaac82328557e290217c558053703f6374284243a2ba17ef69e4cfba3 | 4474227c938f83b02005b90e8b3cb9103cc6c9b7472020eb09af5f00dab 9cd895dbaac82328557e290217c558053703f6374284243a2ba17ef69e4cfba3 9e416802a31ee6a61074dee670fe3a4f9f9897eb9327cff79e0721cab06 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9e416802a31ee6a61074dee670fe3a4f9f9897eb9327cff79e0721cab066f353 | 5dbaac82328557e290217c558053703f6374284243a2ba17ef69e4cfba3 9e416802a31ee6a61074dee670fe3a4f9f9897eb9327cff79e0721cab066f353 9eaa00aa6ca9122a1c7cbeeb3ef2ac0caa52794b85cdf811b0436aba700 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9eaa00aa6ca9122a1c7cbeeb3ef2ac0caa52794b85cdf811b0436aba70097528 | 802a31ee6a61074dee670fe3a4f9f9897eb9327cff79e0721cab066f353 9eaa00aa6ca9122a1c7cbeeb3ef2ac0caa52794b85cdf811b0436aba70097528 a37d84e6c6fe7b4f426f28b0379dba9e3045ac083d46a95f8378c3c98d7 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a37d84e6c6fe7b4f426f28b0379dba9e3045ac083d46a95f8378c3c98d7ca9e2 | 0aa6ca9122a1c7cbeeb3ef2ac0caa52794b85cdf811b0436aba70097528 a37d84e6c6fe7b4f426f28b0379dba9e3045ac083d46a95f8378c3c98d7ca9e2 a91cc0ef59dee1229644bd70f7744bd94d2af6dae19a1cbae685ed06fce | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a778cdaf3d360f5d06be9846bc4ab74d679324bf0e9b03616000367dc27c3f0e | 6ed9cafede731a478242b0f1f13f7263c1bec156adb2f3f26132667464d a778cdaf3d360f5d06be9846bc4ab74d679324bf0e9b03616000367dc27c3f0e e331b749c3f5896adb5a271ea2a4a037e811344162cd574b11892a18a85 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a91cc0ef59dee1229644bd70f7744bd94d2af6dae19a1cbae685ed06fce707ea | 4e6c6fe7b4f426f28b0379dba9e3045ac083d46a95f8378c3c98d7ca9e2 a91cc0ef59dee1229644bd70f7744bd94d2af6dae19a1cbae685ed06fce707ea abb6fe1515e8d0f9d7b23965a35db4a863f92daafa46942d1d42662f993 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | abb6fe1515e8d0f9d7b23965a35db4a863f92daafa46942d1d42662f9937b99a | 0ef59dee1229644bd70f7744bd94d2af6dae19a1cbae685ed06fce707ea abb6fe1515e8d0f9d7b23965a35db4a863f92daafa46942d1d42662f9937b99a af0f00906d833b09adac0caa7028e9691c4090ef041d7cf62a80e8b7b10 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | af0f00906d833b09adac0caa7028e9691c4090ef041d7cf62a80e8b7b10962e6 | e1515e8d0f9d7b23965a35db4a863f92daafa46942d1d42662f9937b99a af0f00906d833b09adac0caa7028e9691c4090ef041d7cf62a80e8b7b10962e6 aff8f8711ca8eed648080884ff84c4dbe62d0ad401af6379def639b9009 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | afa53aa70e484a3d35c1e8a1a50c96f9186f48c7aa10888b5c42b648fa5bfbfb | b8306493ba51bc0ca116a0508d3c1f47389e6fc9a2b313748f4fa3014bc afa53aa70e484a3d35c1e8a1a50c96f9186f48c7aa10888b5c42b648fa5bfbfb 1f8da66ce073a08f45f724bfa31ffe2b266ada3847186018af8d381ffea | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | aff8f8711ca8eed648080884ff84c4dbe62d0ad401af6379def639b90098e802 | 0906d833b09adac0caa7028e9691c4090ef041d7cf62a80e8b7b10962e6 aff8f8711ca8eed648080884ff84c4dbe62d0ad401af6379def639b90098e802 b06746ed57ebeaf64c58217adafad28b9d2445c2d1cbeb67fa7a17a4be9 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b03333b35266db0faf6fc407b36efc2f9f8a574921cf87f4a5fb60a13cbcdb14 | 3156303f7fd02b33d1912f8ee93bf324f5c4fb993993137bd13abfa9a9d b03333b35266db0faf6fc407b36efc2f9f8a574921cf87f4a5fb60a13cbcdb14 f6805cd59dfe012afd50a6bd3ccded29432d444a73016755ee1b217b13b | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b06746ed57ebeaf64c58217adafad28b9d2445c2d1cbeb67fa7a17a4be9a6328 | 8711ca8eed648080884ff84c4dbe62d0ad401af6379def639b90098e802 b06746ed57ebeaf64c58217adafad28b9d2445c2d1cbeb67fa7a17a4be9a6328 b0752f8ae7d2a4922f018c8f02fd0e20d7674eadf94374734b75e64084a | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b0752f8ae7d2a4922f018c8f02fd0e20d7674eadf94374734b75e64084af1d84 | 6ed57ebeaf64c58217adafad28b9d2445c2d1cbeb67fa7a17a4be9a6328 b0752f8ae7d2a4922f018c8f02fd0e20d7674eadf94374734b75e64084af1d84 b098d0fcadab456a28db6cc7cfa9955e1d5c3fb88f9e457121a01af4a31 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b098d0fcadab456a28db6cc7cfa9955e1d5c3fb88f9e457121a01af4a3169ec4 | f8ae7d2a4922f018c8f02fd0e20d7674eadf94374734b75e64084af1d84 b098d0fcadab456a28db6cc7cfa9955e1d5c3fb88f9e457121a01af4a3169ec4 ba264b6fd7795fdea336364082491c7aba457cbf2edabf6c44df0562e34 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b5b222a05156ea8b3c47a1a5da567d191cc8e7a546f2b0edab08a5956ad73ade | b6ec2f87d3044116c955094314d82f340ebc1d8b395513e2be4db3e32a6 b5b222a05156ea8b3c47a1a5da567d191cc8e7a546f2b0edab08a5956ad73ade eff9abfd254271f46d9fba0064a890ef3b0236434938e1ba42bd29fd0f8 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b7bf333f959bb6b6aaaa53a724b5f9b02ea774ba4d093e14052c45fe83e8f02b | 4a1193a0910153f034f6ec7c17feab572392454afb6a8dfd15dd4a38c19 b7bf333f959bb6b6aaaa53a724b5f9b02ea774ba4d093e14052c45fe83e8f02b dcf99c3378de03489a62b131580c1e2fd9df1187ac25912cc6cd856cfe6 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ba264b6fd7795fdea336364082491c7aba457cbf2edabf6c44df0562e34810ba | 0fcadab456a28db6cc7cfa9955e1d5c3fb88f9e457121a01af4a3169ec4 ba264b6fd7795fdea336364082491c7aba457cbf2edabf6c44df0562e34810ba c670d4f30fb06df997adb263c753e21b2a6e2ebdad8ac436c24d4ddf44d | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c2adf4031508ade44343097904c63300c4bfbaa8727fce120a11b09da9bc0be0 | 8a6b53a892ae4e5231de1d2f74a2e51919a66e9e60da3de125c9bd1a521 c2adf4031508ade44343097904c63300c4bfbaa8727fce120a11b09da9bc0be0 596c2b8306493ba51bc0ca116a0508d3c1f47389e6fc9a2b313748f4fa3 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c45b8444e8551666ddd4e13445e3a196039b9065e64ba7102d16067f40e0f412 | dc36455c221a680336ee6ec59320b618c6352621c5d721811e122f83747 c45b8444e8551666ddd4e13445e3a196039b9065e64ba7102d16067f40e0f412 4948be38b1d66191e5f201b88c920ebd4ac7450fb6eaadaf6215b64cd0a | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c5a98f873734fc144f8128c147318599ba993cb0ac103437b37c26774eb51a62 | 9314eb3577075367df11699cafd8a5f6c36da0e58890acebbce4144eb05 c5a98f873734fc144f8128c147318599ba993cb0ac103437b37c26774eb51a62 53362b6ec2f87d3044116c955094314d82f340ebc1d8b395513e2be4db3 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c670d4f30fb06df997adb263c753e21b2a6e2ebdad8ac436c24d4ddf44dc9924 | b6fd7795fdea336364082491c7aba457cbf2edabf6c44df0562e34810ba c670d4f30fb06df997adb263c753e21b2a6e2ebdad8ac436c24d4ddf44dc9924 c9e2d4881b2f8ce1d5503f56815541a90d1c0c7dc008b4e9b8456f05b37 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c7a2bc376d6ddfc678e7c7b3324b021edf19c896a80ab1ec7c2f36bc004ef29e | e23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b83770768e994 c7a2bc376d6ddfc678e7c7b3324b021edf19c896a80ab1ec7c2f36bc004ef29e 1cef688950b9ca01bea0ec9883ab25cebae3db169ff4fb0346968689188 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | c9e2d4881b2f8ce1d5503f56815541a90d1c0c7dc008b4e9b8456f05b377381a | 4f30fb06df997adb263c753e21b2a6e2ebdad8ac436c24d4ddf44dc9924 c9e2d4881b2f8ce1d5503f56815541a90d1c0c7dc008b4e9b8456f05b377381a cc2b53c035e575343bb5436e65b9b15d9fb8782637642c0b4c2ad87c314 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cb57b3c5ec62a83b3096bd2d737cad83119d19939d76b483d0429fd26d492ef4 | 749c3f5896adb5a271ea2a4a037e811344162cd574b11892a18a85c1722 cb57b3c5ec62a83b3096bd2d737cad83119d19939d76b483d0429fd26d492ef4 602353156303f7fd02b33d1912f8ee93bf324f5c4fb993993137bd13abf | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cbbfa84227d82360d79baf8ab4ee0f9a13d0fa7128eac72c0bd627d4dbbb06f9 | 1c0b53592a8f0890447d71bcec5380f104a176277512ee52c063188e151 cbbfa84227d82360d79baf8ab4ee0f9a13d0fa7128eac72c0bd627d4dbbb06f9 3044a4b0cffdeaeeab425109e8cddc597e708f5025849b5d29bff35ce24 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cc2b53c035e575343bb5436e65b9b15d9fb8782637642c0b4c2ad87c314687b5 | 4881b2f8ce1d5503f56815541a90d1c0c7dc008b4e9b8456f05b377381a cc2b53c035e575343bb5436e65b9b15d9fb8782637642c0b4c2ad87c314687b5 cfe49c0ce561b7834275f7f2d9f0cb8977025a095ab25d08c6c36c75863 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cfe49c0ce561b7834275f7f2d9f0cb8977025a095ab25d08c6c36c75863ddcc9 | 3c035e575343bb5436e65b9b15d9fb8782637642c0b4c2ad87c314687b5 cfe49c0ce561b7834275f7f2d9f0cb8977025a095ab25d08c6c36c75863ddcc9 d3e34102a27677946131161ad3d3dce57f15b9b53bd0a1929bc226909b4 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d3e34102a27677946131161ad3d3dce57f15b9b53bd0a1929bc226909b4ceea0 | c0ce561b7834275f7f2d9f0cb8977025a095ab25d08c6c36c75863ddcc9 d3e34102a27677946131161ad3d3dce57f15b9b53bd0a1929bc226909b4ceea0 d5850ed32b01a10d2e6aa4a3997ae8f35cb3c595fde75929d61ecd13fab | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d5850ed32b01a10d2e6aa4a3997ae8f35cb3c595fde75929d61ecd13fab2455c | 102a27677946131161ad3d3dce57f15b9b53bd0a1929bc226909b4ceea0 d5850ed32b01a10d2e6aa4a3997ae8f35cb3c595fde75929d61ecd13fab2455c d906da427d56262f0ab04684edc1ca843618ad8033d063fd249ddd88798 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d906da427d56262f0ab04684edc1ca843618ad8033d063fd249ddd887981488e | ed32b01a10d2e6aa4a3997ae8f35cb3c595fde75929d61ecd13fab2455c d906da427d56262f0ab04684edc1ca843618ad8033d063fd249ddd887981488e dbe42c50bfa0dd6fe0b236fe5371bc294f43d48bbf1243d4f3b2a98041f | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dbe42c50bfa0dd6fe0b236fe5371bc294f43d48bbf1243d4f3b2a98041f0d3ab | a427d56262f0ab04684edc1ca843618ad8033d063fd249ddd887981488e dbe42c50bfa0dd6fe0b236fe5371bc294f43d48bbf1243d4f3b2a98041f0d3ab e0bdde6336208df8807c299ef8157ec7fd9e777dfd1cc1d49534c19e1a4 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dcf99c3378de03489a62b131580c1e2fd9df1187ac25912cc6cd856cfe661037 | 33f959bb6b6aaaa53a724b5f9b02ea774ba4d093e14052c45fe83e8f02b dcf99c3378de03489a62b131580c1e2fd9df1187ac25912cc6cd856cfe661037 555dd50c95045d2bbeae895286a00789089e6a86845975041d11879e7e8 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e0bdde6336208df8807c299ef8157ec7fd9e777dfd1cc1d49534c19e1a44f811 | c50bfa0dd6fe0b236fe5371bc294f43d48bbf1243d4f3b2a98041f0d3ab e0bdde6336208df8807c299ef8157ec7fd9e777dfd1cc1d49534c19e1a44f811 e5114ab13097dff71d3f33dc5b9a9c4fb0206137babf41dde7c4ca61436 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e331b749c3f5896adb5a271ea2a4a037e811344162cd574b11892a18a85c1722 | daf3d360f5d06be9846bc4ab74d679324bf0e9b03616000367dc27c3f0e e331b749c3f5896adb5a271ea2a4a037e811344162cd574b11892a18a85c1722 cb57b3c5ec62a83b3096bd2d737cad83119d19939d76b483d0429fd26d4 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e5114ab13097dff71d3f33dc5b9a9c4fb0206137babf41dde7c4ca614362098c | e6336208df8807c299ef8157ec7fd9e777dfd1cc1d49534c19e1a44f811 e5114ab13097dff71d3f33dc5b9a9c4fb0206137babf41dde7c4ca614362098c e51477fe6b9bf8d73b37825cf4033f34e634ea59e672fed823c4f0850e5 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e51477fe6b9bf8d73b37825cf4033f34e634ea59e672fed823c4f0850e5dce54 | ab13097dff71d3f33dc5b9a9c4fb0206137babf41dde7c4ca614362098c e51477fe6b9bf8d73b37825cf4033f34e634ea59e672fed823c4f0850e5dce54 ece07fc91c99bb3ea3ffdfaadb51e38679cba43287413ea95c8a47d157f | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e9b0adc36455c221a680336ee6ec59320b618c6352621c5d721811e122f83747 | ff638a61503780fb7cb90d85b6f5cb027c8ff732f495a6d13734a5741b1 e9b0adc36455c221a680336ee6ec59320b618c6352621c5d721811e122f83747 c45b8444e8551666ddd4e13445e3a196039b9065e64ba7102d16067f40e | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ece07fc91c99bb3ea3ffdfaadb51e38679cba43287413ea95c8a47d157fcd488 | 7fe6b9bf8d73b37825cf4033f34e634ea59e672fed823c4f0850e5dce54 ece07fc91c99bb3ea3ffdfaadb51e38679cba43287413ea95c8a47d157fcd488 f3e6cacf2a4fa6fa15596416263a0087ec0194db746081a08360cc69bee | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | eff9abfd254271f46d9fba0064a890ef3b0236434938e1ba42bd29fd0f8f60d1 | 2a05156ea8b3c47a1a5da567d191cc8e7a546f2b0edab08a5956ad73ade eff9abfd254271f46d9fba0064a890ef3b0236434938e1ba42bd29fd0f8f60d1 69292e69d48a5151d47aabd30f3056166032ef9f53e877f09bbd69053b7 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f30838a6b53a892ae4e5231de1d2f74a2e51919a66e9e60da3de125c9bd1a521 | a3e9f8d23c784923e9664086ad18aae71ef83e4a60ebfb1fd8bd5abbd80 f30838a6b53a892ae4e5231de1d2f74a2e51919a66e9e60da3de125c9bd1a521 c2adf4031508ade44343097904c63300c4bfbaa8727fce120a11b09da9b | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f3e6cacf2a4fa6fa15596416263a0087ec0194db746081a08360cc69beec2f31 | fc91c99bb3ea3ffdfaadb51e38679cba43287413ea95c8a47d157fcd488 f3e6cacf2a4fa6fa15596416263a0087ec0194db746081a08360cc69beec2f31 fb0f5ff4760f6869a63fc6ed01d19241d83919b88f70343473cb6af014f | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f6805cd59dfe012afd50a6bd3ccded29432d444a73016755ee1b217b13b59fb8 | 3b35266db0faf6fc407b36efc2f9f8a574921cf87f4a5fb60a13cbcdb14 f6805cd59dfe012afd50a6bd3ccded29432d444a73016755ee1b217b13b59fb8 93e2bff638a61503780fb7cb90d85b6f5cb027c8ff732f495a6d13734a5 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fde59700c02a58752cd28d6adb0389a5d69657f6f6925a0bd8ba35a1f724de5c | c7167c369313262fb0fb2bf1ac1db895d04067ed505732ccd3d5ef43b29 fde59700c02a58752cd28d6adb0389a5d69657f6f6925a0bd8ba35a1f724de5c 54162c5399a945f16080d0d8b44cceca3176ecc8e03d03e5aa2295498b7 | Banking Trojans: Ursnif Global Distribution Networks Identified Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 01d681c51ad0c7c3d4b320973c61c28a353624ac665fd390553b364d17911f46 | substitution cipher is used in a variant of Daserf (SHA256: 01d681c51ad0c7c3d4b320973c61c28a353624ac665fd390553b364d17911f46). We also found a very similar table in other Tick tools. S | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 04080fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a | he discussed threats. Indicator of compromise SHA256 Daserf 04080fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cb | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b | 401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1 04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b 42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 055fe8002de293401852310ae76cb730c570f2037c3c832a52a79b70e2cb7831 | 0540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c5b2fe 055fe8002de293401852310ae76cb730c570f2037c3c832a52a79b70e2cb7831 Minzen 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe79 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0df20ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 | 4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 Invader 0df20ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7c | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd355cd | e4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd355cd 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 26727d139b593486237b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 | tified for their associated malware samples: Minzen (SHA256:26727d139b593486237b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82): 1 2 plain text = "5j2Cnx`^@$*(]{}|+mX k3DK'LGc!hHNPgZ | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c5b2fe | 6b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c5b2fe 055fe8002de293401852310ae76cb730c570f2037c3c832a52a79b70e2c | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac | dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b 42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac 7be6eaa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d496875 | 56bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d496875 66c2baa370125448ddf3053d59085b3d6ab78659efee9f152b310e61d2e | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 460328fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea9ade5 | aa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7f86c7 460328fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea9ade5 55dd22448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 55dd22448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 | 8fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea9ade5 55dd22448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb | kickes[.]com was the C2 of another Invader variant (SHA256: 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb). In addition to the infrastructure, the attacker also shar | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 66c2baa370125448ddf3053d59085b3d6ab78659efee9f152b310e61d2e7edb5 | 675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d496875 66c2baa370125448ddf3053d59085b3d6ab78659efee9f152b310e61d2e7edb5 Downloader SHA256 f4c659238ffab95e87894d2c556f887774dce2431 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c | e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe791c08da9ce2b1 | 93401852310ae76cb730c570f2037c3c832a52a79b70e2cb7831 Minzen 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe791c08da9ce2b1 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1 | f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1 04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e2 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7be6eaa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7f86c7 | 84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac 7be6eaa3f9eb288de5606d02bc79e6c8e7fc63935894cd793bc1fab08c7f86c7 460328fe57110fc01837d80c0519fb99ea4a35ea5b890785d1e88c91bea | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849 | aw./BJlk,yUPjgI`^@$*tumYA'p2RoX=v_:M43" Datper (SHA256: 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849): 1 2 plain text = "KhL9V1ds5Z" QnfNC & Fb8xGr - ( ) &l | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 | 3cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 Datper 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e | 6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb 9002 933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e 2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 | ration data in its body. One of the Minzen samples (SHA256: 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2) found in the Republic of Korea in December 2016 installs s | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 | , news.softfix.co[.]kr was the C2 server of Daserf (SHA256: 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423). Another subdomain, bbs.softfix.co[.]kr was hosted on same | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 | 2448e9340d13b439272a177565ace9f5cf69586f8be0443b6f9c81aa6e7 9db387138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 | e0a1bf423ab7e54b9df361360933bac3bb852a31849 HomamDownloader a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 C2 lywjrea.gmarketshop[.]net krjregh.sacreeflame[.]com psfi | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 | n this report using the UBoatRAT Indicators UBoatRAT SHA256 bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271 6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a8 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 | 2e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af0 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 | 9e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7 7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f | b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 NamelessHdoor dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f Gh0stRAt Downloader ce47e7827da145823a6f2b755975d1d2f5eda04 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c | 7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c Custom Gh0st 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 | 7138a1fdfa04127a4841cf024192e41e47491388e133c00325122b3ea82 e52d866e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff478 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 | a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e | ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e | 66e5b77e885e36398249f242f8ff1a224ecce065892dc200c57595bb494 eb92456bf3ab86bd71d74942bb955062550fa10248d67faeeeedd9ff4785f41e 452b1675437ef943988c48932787e2e4decfe8e4c3bed728f490d55b3d4 | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3 | d59085b3d6ab78659efee9f152b310e61d2e7edb5 Downloader SHA256 f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3 Web Access https://raw.githubusercontent[.]com/r1ng/news/ma | UBoatRAT Navigates East Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 | fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a499135 | “Tick” Group Continues Attacks Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e | dca2c2b8dfea34e6f3f723274d88890f6ceb HomamDownloader SHA256 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62b | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8 | 61352ef4f084d969dd30719166b47fdb204828a SysmonLoader SHA256 31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8 Mutex SysMonitor_3A2DCB47 File Path %ProgramFiles%\Windows | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6 | ee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245ccdb16eeaadad3bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd2 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb | 269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2b8dfea34e6f3f723274d88890f6ceb Table 1 Trojanized Korean programs During our investigation | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a | of this file. Trojanized Legitimate Software SHA256 GO Game 8549dcbdfc6885e0e7a1521da61352ef4f084d969dd30719166b47fdb204828a Table 2 Trojanized Japanese language program Despite the di | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78 | 3bcd298e811573b2e68ef2a7077f6f6 Storage encryption software 92e0d0346774127024c672cc7239dd269824a79e85b84c532128fd9663a0ce78 File encryption software 33665d93ab2a0262551c61ec9a3adca2c2 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa | rojanized Legitimate Software SHA256 Movie Player installer b1bb1d5f178b064eb1d7c9cc7cadcf8b3959a940c14cee457ce3aba5795660aa Industrial battery monitoring software 3227d1e39fc3bc842245 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 | 4898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e ee8d025c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602 | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec | 25c6fea5d9177e161dbcedb98e871baceae33b7a4a12e9f73ab62bb0e38 f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec C2 of HomamDownloader pre.englandprevail[.]com | Tick Group Weaponized Secure USB Drives to Target Air Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0641fe04713fbdad272a6f8e9b44631b7554dfd1e1332a8afa767d845a90b3fa | s shown in Table 3, below. Type PATH SHA256 Dropper EXE N/A 0641fe04713fbdad272a6f8e9b44631b7554dfd1e1332a8afa767d845a90b3fa Bisonal EXE %Temp%\[random].tmp 359835C4A9DBE2D95E483464659 | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 1128d10347dd602ecd3228faa389add11415bf6936e2328101311264547afa75 | 6477a1b120ae44368082f8 Bisonal DLL C:\Windows\Temp\pvcu.dll 1128D10347DD602ECD3228FAA389ADD11415BF6936E2328101311264547AFA75 Russian Decoy PDF C:\Windows\Temp\Комплексный проект по соз | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 359835c4a9dbe2d95e483464659744409e877cb6f5d791daa33fd601a01376fc | fd1e1332a8afa767d845a90b3fa Bisonal EXE %Temp%\[random].tmp 359835C4A9DBE2D95E483464659744409E877CB6F5D791DAA33FD601A01376FC Korean Decoy PDF [dropper path]\[same file name without .ex | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 43459f5117bee7b49f2cee7ce934471e01fb2aa2856f230943460e14e19183a6 | in some original Bisonal samples found in 2012. The sample (43459f5117bee7b49f2cee7ce934471e01fb2aa2856f230943460e14e19183a6) contains the marker string “bisonal” which is the origin o | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8 | n below and executes them. Type PATH SHA256 Dropper EXE N/A b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8 Bisonal DLL C:\Windows\Temp\pvcu.dll 1128D10347DD602ECD3228 | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b2b764597d097fcb93c5b11cbd864ab1bcb894a2a1e2d2de1c469880f612431c | Decoy PDF [dropper path]\[same file name without .exe].pdf B2B764597D097FCB93C5B11CBD864AB1BCB894A2A1E2D2DE1C469880F612431C Table 3, File hashes and system installation paths targetin | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dfa1ad6083aa06b82edfa672925bb78c16d4e8cb2510cbe18ea1cf598e7f2722 | he decoy PDF file of another sample of the Bisonal variant (dfa1ad6083aa06b82edfa672925bb78c16d4e8cb2510cbe18ea1cf598e7f2722) submitted to an online malware database in September 2014. | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f431e0bed6b4b7ffef5e40b1b4b7078f2538f2b2db2869d831de5d7df26ee6cd | лищно-строительных кооперативов для работников оборонки.pdf F431E0BED6B4B7FFEF5E40B1B4B7078F2538F2B2DB2869D831DE5D7DF26EE6CD Table 1. File hashes and paths targeting Russia The dropper | Bisonal Malware Used in Attacks Against Russia and South Korea Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 | b36c3940e4dd83f489432fa710fba582e254c3a52459c52826d6a822f2d 0db3fd1394b15b98f4e112102cdec6cc569062cdb199b66c5838c54cbc286277 be3817b9f14df3e0af82ae47b0904ac38d022e2b2d7bb7f8f9800b534b6 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 | wing is the sample list. Domain Marcher SHA256 Sungmap[.]at 254925e47fbfff4786eada6cbcb0805ed79d9bd417955c016236143eb2ecd827 Mountainhigh[.]at 75edaae605622e056a40c2d8a16b86654d7ddc772 | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 27aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633b | c38d022e2b2d7bb7f8f9800b534b60183c Nov 8, 2018 Smoke Loader 27aa9cdf60f1fbff84ede0d77bd49677ec346af050ffd90a43b8dcd528c9633b Nov 9, 2018 Smoke Loader 42fdaffdbacfdf85945bd0e8bfaadb765d | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f415 | 2018 Registers jma-go[.]jp domain Nov 5, 2018 Smoke Loader 3d75eabb8460450a49e2fb68053d9f591efe5aefd379205e5cc3af574bb9f415 Nov 6, 2018 Smoke Loader 8a1aab36c3940e4dd83f489432fa710fba | Analysis of Smoke Loader in New Tsunami Campaign Palo Alto Unit 42 | · Aug 17, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.