Cardinal RAT Sins Again, Targets Israeli Fin

Palo Alto Unit 42by Tom Lancaster, Josh GrunzweigAug 17, 2026 · 12:21 UTC (Aug 17, 2026)10 min read2

AI summary · glm-5.3-flashSummaries by Vani AI

Unit 42 documents updated Cardinal RAT attacks against Israeli FinTech firms, using BMP steganography, MD5-hash obfuscation, and process injection to hinder analysis and detection.

Unit 42 tracked a series of attacks using an updated Cardinal RAT (version 1.7.2) targeting the Israeli financial technology sector. The .NET loader hides a second-stage DLL inside an embedded BMP image decrypted with a single-byte XOR key, and the payload renames functions, methods, and variables to MD5 hashes for obfuscation. The malware installs a startup-folder LNK file and injects its final payload into RegSvcs.exe or RegAsm.exe, communicating with affiliatecollective[.]club over port 443. A possible relationship with the EVILNUM JavaScript malware used against similar organizations was also noted.

Key facts

Payload hidden in embedded BMP via steganography with single-byte XOR
Functions, methods, and variables renamed to MD5 hashes for obfuscation
Installs startup-folder LNK file and injects into RegSvcs.exe or RegAsm.exe
Possible relationship with EVILNUM JavaScript malware targeting similar organizations
C2 at affiliatecollective[.]club on port 443 with keylogging capability

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1027 Obfuscated Files or Information T1547.007 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1055.002 Portable Executable Injection T1056.001 Input Capture: Keylogging

Tags: cardinal-rat evilnum fintech israel rat steganography unit42

Vendors: Palo Alto Networks
Malware: Cardinal RAT Carp Downloader EVILNUM
Organizations: Unit 42
Countries: Israel

Indicators of compromise

auto-extracted · verify before use · export allAll

From the original article

10 min read at unit42.paloaltonetworks.com

In 2017, Unit 42 reported on and analyzed a low-volume malware family called Cardinal RAT . This malware family had remained undetected for over two years and was delivered via a unique downloader named Carp Downloader. Since that publication, we have continued to monitor this threat, resulting in the discovery of a series of attacks using an updated version of Cardinal RAT.

Palo Alto Unit 42

By Tom Lancaster, Josh Grunzweig · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.

Type	Indicator	Context
domain	affiliatecollective.club	} Campaign Identifier: '\xf1\xaf\x02i.]\xa4\xe0' C2 Server: affiliatecollective[.]club C2 Port: 443 Hash Value: 0304674e9876530dfbea5a9b4fec7b98
md5	0304674e9876530dfbea5a9b4fec7b98	Server: affiliatecollective[.]club C2 Port: 443 Hash Value: 0304674e9876530dfbea5a9b4fec7b98 Additional C2 Servers: 0 GUID: '\xd6\x04hr\x9a\xedLN\xae\xe
sha256	0097dd7676b810bd0c1c70d8c86604c830e1e8e88f6a13c3869747faba381076	bbfcd2b343523ed79476f9516cc7d2b041c43841e5e735db4f22ae970c3 0097dd7676b810bd0c1c70d8c86604c830e1e8e88f6a13c3869747faba381076 08ce077e8d54db08ede1095d03286146d04e8cbce74ec91a9fc7b9d0a99
sha256	00f93492edb3274f71686fa469f6c9031a94292a2776c623a1596f710bf4eaa1	35915e0fe313ce58175faa1cc240ae26183fb88d05864bc20ef6d87aca3 00f93492edb3274f71686fa469f6c9031a94292a2776c623a1596f710bf4eaa1 5dcec8a061195bd4a2c3e96afecc48b1f0143b6ac4644c518ed8a923d2d
sha256	01e007b8304eb0cbcb2be11ddb86298dc85c084fb5459eda319a69ef50799f88	LL also compiled with .NET, with the following hash: SHA256 01e007b8304eb0cbcb2be11ddb86298dc85c084fb5459eda319a69ef50799f88 After this file has been loaded in memory, the initial load
sha256	0212334200668ac64cb63fc1a4f4ea17e956f6928a2211c945c2e07f1b25a3ef	5999d3998f578a3acb4bf85e0b3fde102c417c40b6beed0dd3b8ceb51bf 0212334200668ac64cb63fc1a4f4ea17e956f6928a2211c945c2e07f1b25a3ef bae230d6a988723b33158bbeef4ab90b1bff7b521fed9cab0c5e1f5b69a
sha256	02e85f39adf8613fd1be610e4e76f4fac08949f2e0198e8cf89a7c3a17cdd6d9	8a061195bd4a2c3e96afecc48b1f0143b6ac4644c518ed8a923d2dcbe21 02e85f39adf8613fd1be610e4e76f4fac08949f2e0198e8cf89a7c3a17cdd6d9 5e60f17396e2ddfce8e60c964056d63cc3b17646c31b4a4f934c2d1fb4f
sha256	04de4b51c881e65236c9efdbfbc0099e6b48fd1723a6e51bf480b52104dd2ba2	ject into. The final payload has the following hash: SHA256 04de4b51c881e65236c9efdbfbc0099e6b48fd1723a6e51bf480b52104dd2ba2 Underneath all this obfuscation , t his Cardinal RAT payloa
sha256	06151c14153e983ae7ab793c7cd0e5ac3faf8e200894955b02e1191429eff29a	62197744a8caeb09f954213a3172ed699f8375f69c40b57b8c219c5e37c 06151c14153e983ae7ab793c7cd0e5ac3faf8e200894955b02e1191429eff29a 9e6671a8af28e0ab6c37c044d85a2406b665a171ae3bef46f3e90d06e33
sha256	06f1348c8a2ffab67627556075ddcad92998526d4d3802b9c2357d169531825f	3094322b200c53ff016fec29469b3e52def359430113115cc70d7f28704 06f1348c8a2ffab67627556075ddcad92998526d4d3802b9c2357d169531825f ca8af85f7eed79a73984b2dccd3dd2148865dfed7a009842be7372e6ce1
sha256	08ce077e8d54db08ede1095d03286146d04e8cbce74ec91a9fc7b9d0a99ddb9f	d7676b810bd0c1c70d8c86604c830e1e8e88f6a13c3869747faba381076 08ce077e8d54db08ede1095d03286146d04e8cbce74ec91a9fc7b9d0a99ddb9f 28e9e0fcc6899db7a16315d3dca38b6166ba318f8ca07b422ebadaab209
sha256	0afec067628e901f7151861b0924ffb1909d21a707177b1e6cf2c8d491bb1a60	c9a98f2a15aaab9b0488225b0ba4e3d35efa30f6fed9052ffd31042bd7b 0afec067628e901f7151861b0924ffb1909d21a707177b1e6cf2c8d491bb1a60 985d893426373d4e71386d731e5bc44c1c2ac93e0920dddeb4380929af4
sha256	101af6fdb990e5e9584382a65f5cee7efd9e89c38e928beca18419bdf70ef076	265cba1101ae5d63b94c6ad1b47c7d02f0ab4f54a1af3169422791790cf 101af6fdb990e5e9584382a65f5cee7efd9e89c38e928beca18419bdf70ef076 f9bccd349cf841d0f25e81d80a1b4bf73dd960a1f3aa71029a18e36480c
sha256	137f9265cba1101ae5d63b94c6ad1b47c7d02f0ab4f54a1af3169422791790cf	b13f9872a54f91a7bf202b23a8a16de99d054a83ed08b9ea97f9e2675e8 137f9265cba1101ae5d63b94c6ad1b47c7d02f0ab4f54a1af3169422791790cf 101af6fdb990e5e9584382a65f5cee7efd9e89c38e928beca18419bdf70
sha256	154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db	d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db 154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db fc5f7a21d953c394968647df6a37e1f61db04968ad1aca65ad8f261b363
sha256	16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3a4ba6	edcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2 16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3a4ba6 9c47b2af8b8c5f3c25f237dcc375b41835904f7cd99221c7489fb3563c3
sha256	1977cedcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2	bb509ad8230e4d6fa1e6403602a97e60dc8ef517016f86195143cf50f4e 1977cedcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2 16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3
sha256	1e8ed6e8d0b6fc47d8176c874ed40fb09644c058042f34d987878fa644f493cc	1e02d3cf17d77173d50cdaa766661a89721c3cc4050fba98bea0dbdb1a9 1e8ed6e8d0b6fc47d8176c874ed40fb09644c058042f34d987878fa644f493cc 647e379517fed71682423b0192da453ec1d61a633c154fdd55bab762bcc
sha256	20fec2d1824b585aa558b7cf9e9980acd665736ce9f7a124507cf46afb30c79f	0e27bf798cace40ac0d58b833ba3bbf16d80175296601585ed1964465ec 20fec2d1824b585aa558b7cf9e9980acd665736ce9f7a124507cf46afb30c79f dab228c236d48fa1660bcec59e17e5004726741a85b0fbeef8300f29927
sha256	211b7b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2	2af8b8c5f3c25f237dcc375b41835904f7cd99221c7489fb3563c34c9ab 211b7b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2 fd61a5cd1a83f68b75d47c8b6041f8640e47510925caee8176d5d81afac
sha256	2167d393ec89ec0c6e2d7557a7ad22aa1953dd8082f599bee14977c25a128cce	gument #2 to the file path specified in argument #1. SHA256 2167d393ec89ec0c6e2d7557a7ad22aa1953dd8082f599bee14977c25a128cce The malware creates a n LNK file in the victim’s startup fo
sha256	2247c528fc1b90b725d857cc5d45572e864c6c4948100458774f0ef6a8f11403	0fcc6899db7a16315d3dca38b6166ba318f8ca07b422ebadaab209b589b 2247c528fc1b90b725d857cc5d45572e864c6c4948100458774f0ef6a8f11403 dfa041f6cbe9d83cdaaed90466693efca33729c99fa43b29ab8e44bb27e
sha256	267b1df7bc64c1b93b604d964f52801733fdd43efaf7742810b9277f00ad17ff	27ff2220ed269aaa58203e7e89f1988210073d35f5f4019f8ecfd012f81 267b1df7bc64c1b93b604d964f52801733fdd43efaf7742810b9277f00ad17ff e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39a
sha256	268c3c9a98f2a15aaab9b0488225b0ba4e3d35efa30f6fed9052ffd31042bd7b	cfda1730132dbfbf1d46834d771156aac3f7c8e97ea136ca6edbe811fad 268c3c9a98f2a15aaab9b0488225b0ba4e3d35efa30f6fed9052ffd31042bd7b 0afec067628e901f7151861b0924ffb1909d21a707177b1e6cf2c8d491b
sha256	28e9e0fcc6899db7a16315d3dca38b6166ba318f8ca07b422ebadaab209b589b	77e8d54db08ede1095d03286146d04e8cbce74ec91a9fc7b9d0a99ddb9f 28e9e0fcc6899db7a16315d3dca38b6166ba318f8ca07b422ebadaab209b589b 2247c528fc1b90b725d857cc5d45572e864c6c4948100458774f0ef6a8f
sha256	2fbd3d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db	8c86b63ce53edcb62fc2ff2dd8e584e2164451ae0c6f2b1f4d6d0cb6d9c 2fbd3d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db 154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526
sha256	3ec85a019a480114856d3022961d7a55c1ae7cfa81b0073b2c1abcf99e0e541f	6aab53920c497f83eb1f3cbd6b7dbfc2074aab6761b7485aa98f2df139a 3ec85a019a480114856d3022961d7a55c1ae7cfa81b0073b2c1abcf99e0e541f 43fb0b13f9872a54f91a7bf202b23a8a16de99d054a83ed08b9ea97f9e2
sha256	4045950ffa263b92774e92ab36b3ec52bf18f1c133b8d155819629d2ad4b3d1c	1f6cbe9d83cdaaed90466693efca33729c99fa43b29ab8e44bb27eb0a6b 4045950ffa263b92774e92ab36b3ec52bf18f1c133b8d155819629d2ad4b3d1c 85f1053041ef7af8a1c3d941e18de21e7adc24537863063d127bab8a8d2
sha256	427b635915e0fe313ce58175faa1cc240ae26183fb88d05864bc20ef6d87aca3	af5a241112d173147b6b08ad5b7953c940ff5928e3046781c1e58a9c73a 427b635915e0fe313ce58175faa1cc240ae26183fb88d05864bc20ef6d87aca3 00f93492edb3274f71686fa469f6c9031a94292a2776c623a1596f710bf
sha256	43fb0b13f9872a54f91a7bf202b23a8a16de99d054a83ed08b9ea97f9e2675e8	a019a480114856d3022961d7a55c1ae7cfa81b0073b2c1abcf99e0e541f 43fb0b13f9872a54f91a7bf202b23a8a16de99d054a83ed08b9ea97f9e2675e8 137f9265cba1101ae5d63b94c6ad1b47c7d02f0ab4f54a1af3169422791
sha256	440504899b7af6f352cfaad6cdef1642c66927ecce0cf2f7e65d563a78be1b29	d2a9b69509ac16162158729762d30f9ca06146a1828ae17afedd5c243ef 440504899b7af6f352cfaad6cdef1642c66927ecce0cf2f7e65d563a78be1b29 Carp Downloader samples (binaries and…
sha256	448c33094322b200c53ff016fec29469b3e52def359430113115cc70d7f28704	1a8af28e0ab6c37c044d85a2406b665a171ae3bef46f3e90d06e33027ae 448c33094322b200c53ff016fec29469b3e52def359430113115cc70d7f28704 06f1348c8a2ffab67627556075ddcad92998526d4d3802b9c2357d16953
sha256	4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3	7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3 4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3 a05805bcec72fb76b997c456e0fd6c4b219fdc51cad70d4a58c16b0b0e2
sha256	4b4c6b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772	3a6422b0bf680d505720fd07c396508f67518670b493dba902c3c2e5dfa 4b4c6b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772 5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32
sha256	4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227cf01ad	5bcec72fb76b997c456e0fd6c4b219fdc51cad70d4a58c16b0b0e2d9ba1 4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227cf01ad 6272ed2a9b69509ac16162158729762d30f9ca06146a1828ae17afedd5c
sha256	4fde64e9391d36aaff700ce0be3df9e7e6303b6de114332286de694af33dd7da	1792873233693e17fe51c4c86c05d07e31f9b579ab0444dd89733633532 4fde64e9391d36aaff700ce0be3df9e7e6303b6de114332286de694af33dd7da 5909b5999d3998f578a3acb4bf85e0b3fde102c417c40b6beed0dd3b8ce
sha256	5909b5999d3998f578a3acb4bf85e0b3fde102c417c40b6beed0dd3b8ceb51bf	4e9391d36aaff700ce0be3df9e7e6303b6de114332286de694af33dd7da 5909b5999d3998f578a3acb4bf85e0b3fde102c417c40b6beed0dd3b8ceb51bf 0212334200668ac64cb63fc1a4f4ea17e956f6928a2211c945c2e07f1b2
sha256	5dcec8a061195bd4a2c3e96afecc48b1f0143b6ac4644c518ed8a923d2dcbe21	492edb3274f71686fa469f6c9031a94292a2776c623a1596f710bf4eaa1 5dcec8a061195bd4a2c3e96afecc48b1f0143b6ac4644c518ed8a923d2dcbe21 02e85f39adf8613fd1be610e4e76f4fac08949f2e0198e8cf89a7c3a17c
sha256	5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32516f3	b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772 5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32516f3 6e2991e02d3cf17d77173d50cdaa766661a89721c3cc4050fba98bea0db
sha256	5e60f17396e2ddfce8e60c964056d63cc3b17646c31b4a4f934c2d1fb4f5ba71	f39adf8613fd1be610e4e76f4fac08949f2e0198e8cf89a7c3a17cdd6d9 5e60f17396e2ddfce8e60c964056d63cc3b17646c31b4a4f934c2d1fb4f5ba71 cbcb627ff2220ed269aaa58203e7e89f1988210073d35f5f4019f8ecfd0