MB-5baa0e116cc110d7232ace92d612f92cba0a97e1ec6c0125bab8bd0452f06ed0 high

Description

File type: exe. Size: 2599584 bytes. Tags: A, dropped-by-GCleaner, exe, PMIX0.file, signed. Reporter: Bitsight. First seen: 2026-05-14 11:05:49.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• MalwareBazaar sample page Abuse.ch

  File type: exe. Size: 2599584 bytes. Tags: A, dropped-by-GCleaner, exe, PMIX0.file, signed. Reporter: Bitsight. First seen: 2026-05-14 11:05:49.

• THREAT ADVISORY RedSun Zero-Day (Windows Defender) April 17, 2026
  web:blackswan-cybersecurity.com

  Cloud Files API activity originating outside legitimate OneDrive/sync processes. Mitigation Steps: Apply all Windows updates immediately (monitor MSRC for an emergency RedSun-specific patch. None released as of April 17, 2026). Supplement Defender with a secondary EDR solution (e.g., Huntress) capable of detecting Defender bypasses.

  2026-05-22 00:41 UTC
• Mitigate RedSun Zero-Day Without A Patch | Qualys
  web:blog.qualys.com

  How Does the RedSun Vulnerability Exploit Chain Work? At its core, RedSun abuses a logic flaw in how Defender handles cloud-tagged files during remediation . When Defender detects a malicious file carrying a cloud tag, it attempts to restore the file back to its original location rather than simply quarantining or deleting it.

  2026-05-22 00:41 UTC
• Detect emerging threats with Predictive Machine Learning
  web:docs.trendmicro.com

  Use Predictive Machine Learning to detect unknown or low-prevalence malware. For more information, see Predictive Machine Learning. Predictive Machine Learning uses the Advanced Threat Scan Engine (ATSE) to extract file features and sends the report to the Predictive Machine Learning engine on the Trend Micro Smart Protection Network.

  2026-05-22 00:41 UTC
• Configure remediation for Microsoft Defender Antivirus detections
  web:learn.microsoft.com

  Remediation actions can include removing a file , sending it to quarantine, or allowing it to remain. This article includes information and links to resources about specifying what actions should be taken when threats are detected on devices. You can choose from several methods, such as: Configure remediation for Microsoft Defender Antivirus ...

  2026-05-22 00:41 UTC
• Take response actions on a file in Microsoft Defender for Endpoint ...
  web:learn.microsoft.com

  Take response actions on file -related alerts by stopping and quarantining a file or blocking a file and checking activity details.

  2026-05-22 00:41 UTC
• Remediate vulnerabilities with Microsoft Defender Vulnerability ...
  web:learn.microsoft.com

  Microsoft Defender Vulnerability Management allows you to remediate vulnerabilities discovered in your environment through actionable security recommendations. You can create remediation requests that your IT administrator team can use to remediate vulnerabilities using Microsoft Intune.

  2026-05-22 00:41 UTC
• Threat Intelligence & Remediation - Threat Remediation
  web:mimecastsupport.zendesk.com

  Threat Remediation allows: Automatic remediation of any newly found, zero-day attachment-based malware detected in your users' mailboxes, leveraging global threat intelligence to continuously monitor files post-delivery.

  2026-05-22 00:41 UTC
• Analysis & Remediation - Check Point Software
  web:sc1.checkpoint.com

  Analysis & Remediation Automated Attack Analysis (Forensics) Endpoint Security Forensics analyzes attacks detected by other detection features like Anti-Ransomware or Behavioral Guard, and some third-party security products. On detection of a malicious event or file , Forensics is informed and a Forensics analysis is automatically initiated. After the analysis is completed, the entire attack ...

  2026-05-22 00:41 UTC
• Ransomware Mitigation - Bitdefender
  web:www.bitdefender.com

  Ransomware Mitigation uses detection and remediation technologies to keep your data safe from ransomware attacks. Whether the ransomware is known or new, GravityZone detects abnormal encryption attempts and blocks the process.

  2026-05-22 00:41 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  General Mitigation Guidance Restrict or Discontinue Use of FTP and Telnet Services The FTP and Telnet protocols transmit credentials in cleartext, which are susceptible to being intercepted. To mitigate this risk, discontinue FTP and Telnet services by moving to more secure file storage/ file transfer and remote access services.

  2026-05-22 00:41 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.