MB-5521e5e983dab5cd88bade12170967f0b85ea80829eeeed02cd84f9db979ddb4
high
📛 Threat Title
Unknown: payload.bin.malware
Description
File type: exe. Size: 342528 bytes. Tags: exe, MaaS, RAT, TELEPUZ. Reporter: ghozt. First seen: 2026-09-25 04:21:33.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
5521e5e983dab5cd88bade12170967f0b85ea80829eeeed02cd84f9db979ddb4
IOC database
- Type
- hash_sha256
- Value
5521e5e983dab5cd88bade12170967f0b85ea80829eeeed02cd84f9db979ddb4- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
df2522ab1acd2a173aa72ac5940571fef21641cb
IOC database
- Type
- hash_sha1
- Value
df2522ab1acd2a173aa72ac5940571fef21641cb- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
5037c3f4e0689de7577383d2ee80d0ab
IOC database
- Type
- hash_md5
- Value
5037c3f4e0689de7577383d2ee80d0ab- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_imphash
4192b5b49f2dea640789dde909ef651b
IOC database
- Type
- hash_imphash
- Value
4192b5b49f2dea640789dde909ef651b- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 342528 bytes. Tags: exe, MaaS, RAT, TELEPUZ. Reporter: ghozt. First seen: 2026-09-25 04:21:33.
Remediations (10)
-
web:attack.mitre.org
These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module.
-
web:attack.mitre.org
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. [1] Binaries signed with trusted digital certificates can typically ...
-
web:boteraser.com
⚠️ Overview PayloadBIN is a Golang-based loader malware first documented by Huntress Labs in December 2023, primarily operated by an initial-access broker tracked as TA573 (also linked to the Clop ransomware ecosystem). It belongs to the Loader category, functioning as a first-stage dropper for secondary payloads such as Cobalt Strike, Bumblebee, and LockBit via encrypted payload downloads ...
-
web:gbhackers.com
Threat actors on underground forums are now promoting a new "ClickFix" payload-delivery technique that hides malware in the browser cache to evade endpoint detection and response.
-
web:learn.microsoft.com
Learn how to deal with unwanted mitigations in Windows Security, including a process to remove all mitigations and import a baseline configuration file instead.
-
web:malwaretips.com
The Payload Ransomware is malware that encrypts the personal documents found on the victim's computer with the ".Payload" extension, then displays a message which offers to decrypt the data if payment in Bitcoin is made. This article provides an in-depth look at the Payload ransomware - how it works, its unique characteristics, the damage it can cause, and most importantly, what you ...
-
web:unit42.paloaltonetworks.com
Executive Summary In this article, we share hunting tips and mitigation strategies for ClickFix campaigns and provide an inside view of some of the most prominent ClickFix campaigns we have seen so far in 2025: Attackers distributing NetSupport remote access Trojan (RAT) are ramping up activities with a new loader Attackers distributing Latrodectus malware are luring victims with a new ...
-
web:www.malwarebytes.com
We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware.
-
web:www.microsoft.com
Users should also follow the mitigation and protection guidance provided in this blog, including disabling auto-updates for Axios npm packages, since the malicious payload includes a hook that will continue to attempt to update.
-
web:www.microsoft.com
Threat actors are targeting macOS users with fake utility fixes that trick them into running malicious Terminal commands. This campaign evades traditional defenses by stealing credentials, wallets, and sensitive data.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.