CYBERCOM_Malware_Alert - MuddyWater has been seen using a variety of techniques to maintain access to victim networks.
MuddyWater is an Iranian threat actor known for using diverse techniques to maintain persistent access within victim networks. This malware alert highlights their ongoing use of various methods to ensure long-term presence, often targeting organizations for espionage or data exfiltration. The threat actor employs sophisticated payload delivery mechanisms and stealthy persistence techniques, complicating detection and remediation efforts. Although no specific vulnerabilities or exploits are identified, the medium severity reflects the challenge in eradicating their foothold once established. European organizations, especially those in critical infrastructure and government sectors, face risks due to potential espionage and disruption. Mitigation requires tailored detection strategies, including behavioral analytics and threat hunting focused on persistence mechanisms. Countries with higher exposure include those with significant geopolitical interest to Iran, such as Germany, France, the UK, and Poland. Given the complexity and persistence of MuddyWater’s tactics, the suggested severity is high, emphasizing the need for proactive defense measures.
AI Analysis
Technical Summary
MuddyWater is a well-documented Iranian state-sponsored threat actor (intrusion set G0069) known for targeting government, telecommunications, and critical infrastructure sectors primarily in the Middle East, Europe, and Central Asia. This alert from CYBERCOM and CIRCL OSINT highlights MuddyWater's continued use of multiple sophisticated techniques to maintain persistent access within victim networks. These techniques include deploying custom malware payloads, leveraging legitimate tools for lateral movement, and establishing stealthy backdoors that evade traditional detection. The group’s persistence methods often involve modifying system configurations, abusing scheduled tasks, and using living-off-the-land binaries to blend in with normal network activity. Although no specific vulnerabilities or exploits are cited, the threat actor’s ability to maintain long-term access poses significant risks of espionage, data theft, and potential disruption. The medium severity rating reflects the moderate certainty (50%) and the complexity of detection and remediation. The alert does not indicate any patch availability or known exploits in the wild, underscoring that the threat is operationally driven rather than vulnerability-based. MuddyWater’s targeting aligns with geopolitical objectives of Iran, focusing on intelligence gathering and influence operations. The technical details are limited, but the persistent nature of the threat requires organizations to adopt advanced detection and response capabilities.
Potential Impact
For European organizations, the impact of MuddyWater’s persistent access techniques can be substantial. Compromise can lead to unauthorized data exfiltration, intellectual property theft, and espionage targeting sensitive government or corporate information. Persistent footholds enable attackers to conduct prolonged surveillance and potentially disrupt critical services. The stealthy nature of their malware and use of legitimate system tools complicate detection, increasing the risk of extended undetected presence. This can undermine trust in affected organizations and cause reputational damage. Additionally, if the threat actor escalates privileges or moves laterally, it could impact availability of critical systems. The geopolitical context means that organizations involved in defense, energy, telecommunications, and government administration are particularly at risk. The medium severity suggests a moderate likelihood of impact, but the potential for high-impact espionage or disruption exists if access is maintained long-term.
Mitigation Recommendations
Mitigation should focus on advanced threat detection and response tailored to persistence techniques rather than relying solely on patching. Organizations should implement continuous monitoring with behavioral analytics to detect anomalies such as unusual scheduled tasks, unauthorized use of living-off-the-land binaries, and unexpected network connections. Employ threat hunting exercises focused on known MuddyWater tactics and indicators of compromise, even if specific IOCs are not currently available. Harden endpoint security by restricting administrative privileges and applying application whitelisting to limit execution of unauthorized binaries. Network segmentation can reduce lateral movement opportunities. Regularly review and audit system configurations and scheduled tasks for unauthorized changes. Employ multi-factor authentication and strict access controls to reduce the risk of initial compromise. Collaboration with national CERTs and sharing threat intelligence can improve detection capabilities. Finally, conduct regular incident response drills to prepare for potential intrusions by persistent threat actors.
Affected Countries
Germany, France, United Kingdom, Poland, Italy, Netherlands
Indicators of Compromise
- hash: 3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8
- hash: 42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986
- hash: b1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c
- hash: 255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a
- hash: e7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca
- hash: 5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f
- hash: 9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7
- hash: b6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a
- hash: 9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2
- hash: 7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4
- hash: e7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13
- hash: b5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504
- hash: dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92
- hash: 9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051
- hash: 12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa
- hash: ce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9
- hash: 2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82
- hash: a0421312705e847a1c8073001fd8499c
- hash: 3204447f54adeffb339ed3e00649ae428544eca3
- hash: 9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7
- datetime: 2022-01-13T12:41:30+00:00
- link: https://www.virustotal.com/gui/file/9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7/detection/f-9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7-1642077690
- text: 8/57
- hash: 4a022ea1fd2bf5e8c0d8b2343a230070
- hash: 89df0feca9a447465d41ac87cb45a6f3c02c574d
- hash: e7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13
- datetime: 2022-01-13T04:17:48+00:00
- link: https://www.virustotal.com/gui/file/e7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13/detection/f-e7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13-1642047468
- text: 12/56
- hash: 52299ffc8373f58b62543ec754732e55
- hash: ca97ac295b2cd57501517c0efd67b6f8a7d1fbdf
- hash: ce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9
- datetime: 2022-01-13T09:17:23+00:00
- link: https://www.virustotal.com/gui/file/ce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9/detection/f-ce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9-1642065443
- text: 0/57
- hash: 37fa9e6b9be7242984a39a024cade2d5
- hash: 0211569091b96cffab6918e18ccc97f4b24d88d4
- hash: 42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986
- datetime: 2022-01-13T13:07:07+00:00
- link: https://www.virustotal.com/gui/file/42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986/detection/f-42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986-1642079227
- text: 15/56
- hash: c0c2cd5cc018e575816c08b36969c4a6
- hash: 47a4e0d466bb20cec5d354e56a9aa3f07cec816a
- hash: b1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c
- datetime: 2022-01-13T09:15:56+00:00
- link: https://www.virustotal.com/gui/file/b1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c/detection/f-b1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c-1642065356
- text: 7/56
- hash: b6b0edf0b31bc95a042e13f3768a65c3
- hash: 5168a8880abe8eb2d28f10787820185fe318859e
- hash: b6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a
- datetime: 2022-01-13T07:08:21+00:00
- link: https://www.virustotal.com/gui/file/b6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a/detection/f-b6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a-1642057701
- text: 0/56
- hash: 0431445d6d6e5802c207c8bc6a6402ea
- hash: 3765c1ad8a1d936aad88255aef5d6d4ce24f94e8
- hash: 3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8
- datetime: 2022-01-13T13:04:20+00:00
- link: https://www.virustotal.com/gui/file/3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8/detection/f-3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8-1642079060
- text: 26/63
- hash: a65696d6b65f7159c9ffcd4119f60195
- hash: 570f7272412ff8257ed6868d90727a459e3b179e
- hash: b5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504
- datetime: 2022-01-13T08:14:02+00:00
- link: https://www.virustotal.com/gui/file/b5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504/detection/f-b5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504-1642061642
- text: 12/57
- hash: 51bc53a388fce06487743eadc64c4356
- hash: b9e6fc51fa3940fb632a68907b8513634d76e5a0
- hash: 9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2
- datetime: 2022-01-13T12:41:47+00:00
- link: https://www.virustotal.com/gui/file/9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2/detection/f-9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2-1642077707
- text: 1/57
- hash: 0ac499496fb48de0727bbef858dadbee
- hash: 483cd5c9dd887367793261730d59178c19fe13f3
- hash: 255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a
- datetime: 2022-01-13T04:15:36+00:00
- link: https://www.virustotal.com/gui/file/255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a/detection/f-255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a-1642047336
- text: 0/56
- hash: 860f5c2345e8f5c268c9746337ade8b7
- hash: 6c55d3acdc2d8d331f0d13024f736bc28ef5a7e1
- hash: 9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051
- datetime: 2022-01-13T06:21:14+00:00
- link: https://www.virustotal.com/gui/file/9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051/detection/f-9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051-1642054874
- text: 20/66
- hash: d68f5417f1d4fc022067bf0313a3867d
- hash: 2f6dd6d11e28bf8b4d7ceec8753d15c7568fb22e
- hash: e7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca
- datetime: 2022-01-13T12:26:10+00:00
- link: https://www.virustotal.com/gui/file/e7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca/detection/f-e7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca-1642076770
- text: 0/56
- hash: 6c084c8f5a61c6bec5eb5573a2d51ffb
- hash: 61608ed1de56d0e4fe6af07ecba0bd0a69d825b8
- hash: 7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4
- datetime: 2022-01-13T07:05:59+00:00
- link: https://www.virustotal.com/gui/file/7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4/detection/f-7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4-1642057559
- text: 42/68
- hash: 218d4151b39e4ece13d3bf5ff4d1121b
- hash: 28e799d9769bb7e936d1768d498a0d2c7a0d53fb
- hash: 2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82
- datetime: 2022-01-13T08:47:01+00:00
- link: https://www.virustotal.com/gui/file/2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82/detection/f-2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82-1642063621
- text: 11/54
- hash: a27655d14b0aabec8db70ae08a623317
- hash: 8344f2c1096687ed83c2bbad0e6e549a71b0c0b1
- hash: 12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa
- datetime: 2022-01-13T13:53:27+00:00
- link: https://www.virustotal.com/gui/file/12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa/detection/f-12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa-1642082007
- text: 24/68
- hash: cec48bcdedebc962ce45b63e201c0624
- hash: 81f46998c92427032378e5dead48bdfc9128b225
- hash: dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92
- datetime: 2022-01-13T03:08:18+00:00
- link: https://www.virustotal.com/gui/file/dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92/detection/f-dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92-1642043298
- text: 35/66
- hash: a16f4f0c00ca43d5b20f7bc30a3f3559
- hash: 94e26fb2738e49bb70b445315c0d63a5d364c71b
- hash: 5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f
- datetime: 2022-01-13T02:57:46+00:00
- link: https://www.virustotal.com/gui/file/5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f/detection/f-5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f-1642042666
- text: 3/56
CYBERCOM_Malware_Alert - MuddyWater has been seen using a variety of techniques to maintain access to victim networks.
Description
MuddyWater is an Iranian threat actor known for using diverse techniques to maintain persistent access within victim networks. This malware alert highlights their ongoing use of various methods to ensure long-term presence, often targeting organizations for espionage or data exfiltration. The threat actor employs sophisticated payload delivery mechanisms and stealthy persistence techniques, complicating detection and remediation efforts. Although no specific vulnerabilities or exploits are identified, the medium severity reflects the challenge in eradicating their foothold once established. European organizations, especially those in critical infrastructure and government sectors, face risks due to potential espionage and disruption. Mitigation requires tailored detection strategies, including behavioral analytics and threat hunting focused on persistence mechanisms. Countries with higher exposure include those with significant geopolitical interest to Iran, such as Germany, France, the UK, and Poland. Given the complexity and persistence of MuddyWater’s tactics, the suggested severity is high, emphasizing the need for proactive defense measures.
AI-Powered Analysis
Technical Analysis
MuddyWater is a well-documented Iranian state-sponsored threat actor (intrusion set G0069) known for targeting government, telecommunications, and critical infrastructure sectors primarily in the Middle East, Europe, and Central Asia. This alert from CYBERCOM and CIRCL OSINT highlights MuddyWater's continued use of multiple sophisticated techniques to maintain persistent access within victim networks. These techniques include deploying custom malware payloads, leveraging legitimate tools for lateral movement, and establishing stealthy backdoors that evade traditional detection. The group’s persistence methods often involve modifying system configurations, abusing scheduled tasks, and using living-off-the-land binaries to blend in with normal network activity. Although no specific vulnerabilities or exploits are cited, the threat actor’s ability to maintain long-term access poses significant risks of espionage, data theft, and potential disruption. The medium severity rating reflects the moderate certainty (50%) and the complexity of detection and remediation. The alert does not indicate any patch availability or known exploits in the wild, underscoring that the threat is operationally driven rather than vulnerability-based. MuddyWater’s targeting aligns with geopolitical objectives of Iran, focusing on intelligence gathering and influence operations. The technical details are limited, but the persistent nature of the threat requires organizations to adopt advanced detection and response capabilities.
Potential Impact
For European organizations, the impact of MuddyWater’s persistent access techniques can be substantial. Compromise can lead to unauthorized data exfiltration, intellectual property theft, and espionage targeting sensitive government or corporate information. Persistent footholds enable attackers to conduct prolonged surveillance and potentially disrupt critical services. The stealthy nature of their malware and use of legitimate system tools complicate detection, increasing the risk of extended undetected presence. This can undermine trust in affected organizations and cause reputational damage. Additionally, if the threat actor escalates privileges or moves laterally, it could impact availability of critical systems. The geopolitical context means that organizations involved in defense, energy, telecommunications, and government administration are particularly at risk. The medium severity suggests a moderate likelihood of impact, but the potential for high-impact espionage or disruption exists if access is maintained long-term.
Mitigation Recommendations
Mitigation should focus on advanced threat detection and response tailored to persistence techniques rather than relying solely on patching. Organizations should implement continuous monitoring with behavioral analytics to detect anomalies such as unusual scheduled tasks, unauthorized use of living-off-the-land binaries, and unexpected network connections. Employ threat hunting exercises focused on known MuddyWater tactics and indicators of compromise, even if specific IOCs are not currently available. Harden endpoint security by restricting administrative privileges and applying application whitelisting to limit execution of unauthorized binaries. Network segmentation can reduce lateral movement opportunities. Regularly review and audit system configurations and scheduled tasks for unauthorized changes. Employ multi-factor authentication and strict access controls to reduce the risk of initial compromise. Collaboration with national CERTs and sharing threat intelligence can improve detection capabilities. Finally, conduct regular incident response drills to prepare for potential intrusions by persistent threat actors.
Affected Countries
Technical Details
- Uuid
- ed46f822-41e6-4dca-a1c5-ad768306bfe9
- Original Timestamp
- 1642082225
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8 | — | |
hash42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986 | — | |
hashb1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c | — | |
hash255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a | — | |
hashe7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca | — | |
hash5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f | — | |
hash9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7 | — | |
hashb6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a | — | |
hash9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2 | — | |
hash7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4 | — | |
hashe7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13 | — | |
hashb5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504 | — | |
hashdd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92 | — | |
hash9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051 | — | |
hash12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa | — | |
hashce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9 | — | |
hash2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82 | — | |
hasha0421312705e847a1c8073001fd8499c | — | |
hash3204447f54adeffb339ed3e00649ae428544eca3 | — | |
hash9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7 | — | |
hash4a022ea1fd2bf5e8c0d8b2343a230070 | — | |
hash89df0feca9a447465d41ac87cb45a6f3c02c574d | — | |
hashe7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13 | — | |
hash52299ffc8373f58b62543ec754732e55 | — | |
hashca97ac295b2cd57501517c0efd67b6f8a7d1fbdf | — | |
hashce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9 | — | |
hash37fa9e6b9be7242984a39a024cade2d5 | — | |
hash0211569091b96cffab6918e18ccc97f4b24d88d4 | — | |
hash42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986 | — | |
hashc0c2cd5cc018e575816c08b36969c4a6 | — | |
hash47a4e0d466bb20cec5d354e56a9aa3f07cec816a | — | |
hashb1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c | — | |
hashb6b0edf0b31bc95a042e13f3768a65c3 | — | |
hash5168a8880abe8eb2d28f10787820185fe318859e | — | |
hashb6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a | — | |
hash0431445d6d6e5802c207c8bc6a6402ea | — | |
hash3765c1ad8a1d936aad88255aef5d6d4ce24f94e8 | — | |
hash3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8 | — | |
hasha65696d6b65f7159c9ffcd4119f60195 | — | |
hash570f7272412ff8257ed6868d90727a459e3b179e | — | |
hashb5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504 | — | |
hash51bc53a388fce06487743eadc64c4356 | — | |
hashb9e6fc51fa3940fb632a68907b8513634d76e5a0 | — | |
hash9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2 | — | |
hash0ac499496fb48de0727bbef858dadbee | — | |
hash483cd5c9dd887367793261730d59178c19fe13f3 | — | |
hash255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a | — | |
hash860f5c2345e8f5c268c9746337ade8b7 | — | |
hash6c55d3acdc2d8d331f0d13024f736bc28ef5a7e1 | — | |
hash9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051 | — | |
hashd68f5417f1d4fc022067bf0313a3867d | — | |
hash2f6dd6d11e28bf8b4d7ceec8753d15c7568fb22e | — | |
hashe7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca | — | |
hash6c084c8f5a61c6bec5eb5573a2d51ffb | — | |
hash61608ed1de56d0e4fe6af07ecba0bd0a69d825b8 | — | |
hash7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4 | — | |
hash218d4151b39e4ece13d3bf5ff4d1121b | — | |
hash28e799d9769bb7e936d1768d498a0d2c7a0d53fb | — | |
hash2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82 | — | |
hasha27655d14b0aabec8db70ae08a623317 | — | |
hash8344f2c1096687ed83c2bbad0e6e549a71b0c0b1 | — | |
hash12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa | — | |
hashcec48bcdedebc962ce45b63e201c0624 | — | |
hash81f46998c92427032378e5dead48bdfc9128b225 | — | |
hashdd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92 | — | |
hasha16f4f0c00ca43d5b20f7bc30a3f3559 | — | |
hash94e26fb2738e49bb70b445315c0d63a5d364c71b | — | |
hash5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f | — |
Datetime
| Value | Description | Copy |
|---|---|---|
datetime2022-01-13T12:41:30+00:00 | — | |
datetime2022-01-13T04:17:48+00:00 | — | |
datetime2022-01-13T09:17:23+00:00 | — | |
datetime2022-01-13T13:07:07+00:00 | — | |
datetime2022-01-13T09:15:56+00:00 | — | |
datetime2022-01-13T07:08:21+00:00 | — | |
datetime2022-01-13T13:04:20+00:00 | — | |
datetime2022-01-13T08:14:02+00:00 | — | |
datetime2022-01-13T12:41:47+00:00 | — | |
datetime2022-01-13T04:15:36+00:00 | — | |
datetime2022-01-13T06:21:14+00:00 | — | |
datetime2022-01-13T12:26:10+00:00 | — | |
datetime2022-01-13T07:05:59+00:00 | — | |
datetime2022-01-13T08:47:01+00:00 | — | |
datetime2022-01-13T13:53:27+00:00 | — | |
datetime2022-01-13T03:08:18+00:00 | — | |
datetime2022-01-13T02:57:46+00:00 | — |
Link
| Value | Description | Copy |
|---|---|---|
linkhttps://www.virustotal.com/gui/file/9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7/detection/f-9cb79736302999a7ec4151a43e93cd51c97ede879194cece5e46b4ff471a7af7-1642077690 | — | |
linkhttps://www.virustotal.com/gui/file/e7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13/detection/f-e7baf353aa12ff2571fc5c45184631dc2692e2f0a61b799e29a1525969bf2d13-1642047468 | — | |
linkhttps://www.virustotal.com/gui/file/ce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9/detection/f-ce9bd1acf37119ff73b4dff989f2791eb24efc891a413df58856d848f0bcaee9-1642065443 | — | |
linkhttps://www.virustotal.com/gui/file/42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986/detection/f-42ca7d3fcd6d220cd380f34f9aa728b3bb68908b49f04d04f685631ee1f78986-1642079227 | — | |
linkhttps://www.virustotal.com/gui/file/b1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c/detection/f-b1e30cce6df16d83b82b751edca57aa17795d8d0cdd960ecee7d90832b0ee76c-1642065356 | — | |
linkhttps://www.virustotal.com/gui/file/b6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a/detection/f-b6133e04a0a1deb8faf944dd79c46c62f725a72ea9f26dd911d6f6e1e4433f1a-1642057701 | — | |
linkhttps://www.virustotal.com/gui/file/3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8/detection/f-3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8-1642079060 | — | |
linkhttps://www.virustotal.com/gui/file/b5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504/detection/f-b5b1e26312e0574464ddef92c51d5f597e07dba90617c0528ec9f494af7e8504-1642061642 | — | |
linkhttps://www.virustotal.com/gui/file/9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2/detection/f-9ec8319e278d1b3fa1ccf87b5ce7dd6802dac76881e4e4e16e240c5a98f107e2-1642077707 | — | |
linkhttps://www.virustotal.com/gui/file/255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a/detection/f-255e53af8b079c8319ce52583293723551da9affe547da45e2c1d4257cff625a-1642047336 | — | |
linkhttps://www.virustotal.com/gui/file/9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051/detection/f-9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051-1642054874 | — | |
linkhttps://www.virustotal.com/gui/file/e7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca/detection/f-e7f6c7b91c482c12fc905b84dbaa9001ef78dc6a771773e1de4b8eade5431eca-1642076770 | — | |
linkhttps://www.virustotal.com/gui/file/7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4/detection/f-7e7545d14df7b618b3b1bc24321780c164a0a14d3600dbac0f91afbce1a2f9f4-1642057559 | — | |
linkhttps://www.virustotal.com/gui/file/2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82/detection/f-2471a039cb1ddeb826f3a11f89b193624d89052afcbee01205dc92610723eb82-1642063621 | — | |
linkhttps://www.virustotal.com/gui/file/12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa/detection/f-12db8bcee090521ecf852bf215ce3878737517a22ef1f2ff9bdec7cba8d0d3aa-1642082007 | — | |
linkhttps://www.virustotal.com/gui/file/dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92/detection/f-dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92-1642043298 | — | |
linkhttps://www.virustotal.com/gui/file/5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f/detection/f-5bcdd422089ed96d6711fa251544e2e863b113973db328590cfe0457bfeb564f-1642042666 | — |
Text
| Value | Description | Copy |
|---|---|---|
text8/57 | — | |
text12/56 | — | |
text0/57 | — | |
text15/56 | — | |
text7/56 | — | |
text0/56 | — | |
text26/63 | — | |
text12/57 | — | |
text1/57 | — | |
text0/56 | — | |
text20/66 | — | |
text0/56 | — | |
text42/68 | — | |
text11/54 | — | |
text24/68 | — | |
text35/66 | — | |
text3/56 | — |
Threat ID: 68359ca05d5f0974d01fc8fb
Added to database: 5/27/2025, 11:06:08 AM
Last enriched: 12/24/2025, 6:15:28 AM
Last updated: 2/7/2026, 7:08:28 PM
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery
MediumThreatFox IOCs for 2026-02-06
MediumThreatFox IOCs for 2026-02-05
MediumTechnical Analysis of Marco Stealer
MediumNew Clickfix variant 'CrashFix' deploying Python Remote Access Trojan
MediumActions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.