MB-a4a216ad5dfcf89c7029236608a64eaf457a276e4e955de04dcd7ee1441677fa
high
📛 Threat Title
Unknown: file
Description
File type: exe. Size: 15360 bytes. Tags: 5a4378fb90db39f09c7b18d1f314e645, dropped-by-remus, exe. Reporter: Bitsight. First seen: 2026-09-23 23:38:13.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_imphash
c64a9aaa58707c34f0569020880351cb
IOC database
- Type
- hash_imphash
- Value
c64a9aaa58707c34f0569020880351cb- First seen
- Last seen
- Attached to this threat
- Appears in
- 639 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
a4a216ad5dfcf89c7029236608a64eaf457a276e4e955de04dcd7ee1441677fa
IOC database
- Type
- hash_sha256
- Value
a4a216ad5dfcf89c7029236608a64eaf457a276e4e955de04dcd7ee1441677fa- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
c2ae0175d0cf3dec44ab3e6b9127bfcb5987b6ab
IOC database
- Type
- hash_sha1
- Value
c2ae0175d0cf3dec44ab3e6b9127bfcb5987b6ab- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
b29ab1e0c3f4786ae0fc5c88c0ee56f3
IOC database
- Type
- hash_md5
- Value
b29ab1e0c3f4786ae0fc5c88c0ee56f3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 15360 bytes. Tags: 5a4378fb90db39f09c7b18d1f314e645, dropped-by-remus, exe. Reporter: Bitsight. First seen: 2026-09-23 23:38:13.
Remediations (10)
-
web:learn.microsoft.com
Block known vulnerable app versions as a mitigation step in Microsoft Defender Vulnerability Management. Learn about prerequisites, block and warn actions, and how file indicators prevent execution while remediation is in progress.
-
web:learn.microsoft.com
Microsoft Defender Vulnerability Management allows you to remediate vulnerabilities discovered in your environment through actionable security recommendations. You can create remediation requests that your IT administrator team can use to remediate vulnerabilities using Microsoft Intune.
-
web:microsoft.github.io
This capability supports the "Assume Breach" principle of Zero Trust by ensuring continuous detection and mitigation of weaknesses. Reference Remediate machine vulnerability findings - Microsoft Defender for Cloud Vulnerability scanning in Defender for Servers Remediate vulnerabilities with Microsoft Defender Vulnerability Management
-
web:orca.security
Microsoft patches CVE-2026-21509, a high-severity Office zero-day actively exploited in the wild. Learn about the OLE bypass, affected versions, and remediation .
-
web:windowsforum.com
Microsoft's February Patch Tuesday closed a dangerous loophole in the modern Notepad app that could let an attacker turn a simple Markdown (.md) file into a remote code execution (RCE) trap — a single click on a crafted link inside Notepad's Markdown view could launch unverified protocols and cause arbitrary code to run with the user's privileges. (msrc.microsoft.com) Background ...
-
web:www.aomeitech.com
Interference from third-party security tools, such as quarantining files independently, or interfering with system access, etc. How to Fix Remediation Incomplete in Windows Defender When Windows Defender reports " Remediation Incomplete" it means a threat was detected but not fully removed.
-
web:www.herodevs.com
Understand CVE-2026-66066: a critical RCE vulnerability in Ruby on Rails Active Storage. Learn how an unsafe libvips default enables arbitrary file read and how to secure your application.
-
web:www.ninjaone.com
Learn how to restore safe files or permanently remove quarantined files in Windows 11 using Windows Security and PowerShell for IT admins and MSPs.
-
web:www.rescana.com
Given the active exploitation and the high impact potential, urgent remediation is required for all organizations utilizing affected Microsoft Office products. This advisory provides a comprehensive technical breakdown, exploitation context, and actionable mitigation guidance to help organizations defend against this evolving threat.
-
web:www.sentinelone.com
A vulnerability remediation program helps you identify, analyze, prioritize, and eliminate security weaknesses before cyber attackers could exploit them.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.