MB-135607be3db66b1e5d6894ac1e8a02c81acbb99491b542840df6ec3299bf0822
high
📛 Threat Title
Unknown: file
Description
File type: exe. Size: 8198096 bytes. Tags: d52f85, dropped-by-Amadey, exe. Reporter: Bitsight. First seen: 2026-05-14 15:08:57.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
135607be3db66b1e5d6894ac1e8a02c81acbb99491b542840df6ec3299bf0822
1 feed
IOC database
- Type
- hash_sha256
- Value
135607be3db66b1e5d6894ac1e8a02c81acbb99491b542840df6ec3299bf0822- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Unknown
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
a50072e2cdc9a8325d06d03d271e6efa6172977c
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/a50072e2cdc9a8325d06d03d271e6efa6172977c
2 feeds
IOC database
- Type
- hash_sha1
- Value
a50072e2cdc9a8325d06d03d271e6efa6172977c- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/a50072e2cdc9a8325d06d03d271e6efa6172977c
hash_md5
f77cfad4cadff7777249aa8d1aab0168
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/f77cfad4cadff7777249aa8d1aab0168
2 feeds
IOC database
- Type
- hash_md5
- Value
f77cfad4cadff7777249aa8d1aab0168- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/f77cfad4cadff7777249aa8d1aab0168
hash_imphash
2ac0c4d3fec4c7e9ce9158815bb62c6f
IOC database
- Type
- hash_imphash
- Value
2ac0c4d3fec4c7e9ce9158815bb62c6f- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 8198096 bytes. Tags: d52f85, dropped-by-Amadey, exe. Reporter: Bitsight. First seen: 2026-05-14 15:08:57.
Remediations (10)
-
web:blog.qualys.com
How Does the RedSun Vulnerability Exploit Chain Work? At its core, RedSun abuses a logic flaw in how Defender handles cloud-tagged files during remediation . When Defender detects a malicious file carrying a cloud tag, it attempts to restore the file back to its original location rather than simply quarantining or deleting it.
-
web:help.deepsecurity.trendmicro.com
Use Predictive Machine Learning to detect unknown or low-prevalence malware. (For more information, see Predictive Machine Learning.) Predictive Machine Learning uses the Advanced Threat Scan Engine (ATSE) to extract file features and sends the report to the Predictive Machine Learning engine on the Trend Micro Smart Protection Network.
-
web:learn.microsoft.com
Remediation actions can include removing a file , sending it to quarantine, or allowing it to remain. This article includes information and links to resources about specifying what actions should be taken when threats are detected on devices. You can choose from several methods, such as: Configure remediation for Microsoft Defender Antivirus ...
-
web:learn.microsoft.com
Take response actions on file -related alerts by stopping and quarantining a file or blocking a file and checking activity details.
-
web:learn.microsoft.com
Microsoft Defender Vulnerability Management allows you to remediate vulnerabilities discovered in your environment through actionable security recommendations. You can create remediation requests that your IT administrator team can use to remediate vulnerabilities using Microsoft Intune.
-
web:mimecastsupport.zendesk.com
Incidents correspond to a Remediation event and display all the associated messages by the recipient. After viewing an incident, you can perform the following actions: Remove an attachment/message...
-
web:sc1.checkpoint.com
Analysis & Remediation Automated Attack Analysis (Forensics) Endpoint Security Forensics analyzes attacks detected by other detection features like Anti-Ransomware or Behavioral Guard, and some third-party security products. On detection of a malicious event or file , Forensics is informed and a Forensics analysis is automatically initiated. After the analysis is completed, the entire attack ...
-
web:www.bitdefender.com
Ransomware Mitigation uses detection and remediation technologies to keep your data safe from ransomware attacks. Whether the ransomware is known or new, GravityZone detects abnormal encryption attempts and blocks the process.
-
web:www.cisa.gov
General Mitigation Guidance Restrict or Discontinue Use of FTP and Telnet Services The FTP and Telnet protocols transmit credentials in cleartext, which are susceptible to being intercepted. To mitigate this risk, discontinue FTP and Telnet services by moving to more secure file storage/ file transfer and remote access services.
-
web:www.reddit.com
If you don't have the in house staff to perform the threat analysis or threat hunting, you need a SOC. You could look at black point cyber since your are a PAX 8 customer. You currently have the detection portion of EDR, but not the analysis and remediation piece. You can't compare Symantec to Sentinel One, they aren't the same. Sentinel One IMO, is a far superior product, and in the years we ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.