MB-aee563de1f5717284ec3fc3dfa17beb00f90f95d1eccb42727c9f842ec21d4f0
high
📛 Threat Title
Unknown: agent.bin.arm64
Description
File type: elf. Size: 8536888 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-11-08 07:52:27.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
aee563de1f5717284ec3fc3dfa17beb00f90f95d1eccb42727c9f842ec21d4f0
IOC database
- Type
- hash_sha256
- Value
aee563de1f5717284ec3fc3dfa17beb00f90f95d1eccb42727c9f842ec21d4f0- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
0239177ce779f109ba3a51b8f811cc6687d7e9f0
IOC database
- Type
- hash_sha1
- Value
0239177ce779f109ba3a51b8f811cc6687d7e9f0- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
5f07280961d04fef837e71db4f63a736
IOC database
- Type
- hash_md5
- Value
5f07280961d04fef837e71db4f63a736- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 8536888 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-11-08 07:52:27.
Remediations (10)
-
web:admin365.blog
Learn how to create Intune detection and remediation scripts in PowerShell. Step-by-step guide for deploying, scheduling, and validating compliance packages in Intune.
-
web:cloudflow.be
Let's talk about something that hit a little too close to home recently: Hotpatching on ARM64 devices — and more importantly, why it breaks things if you don't disable CHPE first. I'm writing this post because — well, you guessed it — one of my lovely colleagues enabled Hotpatch on my ARM64 test device. And yes… it completely broke everything. No, seriously. This wasn't the ...
-
web:github.com
Endpoint Analytics Remediation Scripts is a deployable script library for Intune administrators who want ready-to-use detection and remediation packages. The repository is organized around script folders, where each package can be reviewed, tested, and then deployed through Microsoft Intune proactive remediations .
-
web:github.com
This remediation script enables Windows Hotpatching on Arm64-based Windows devices by disabling the use of CHPE (Compiled Hybrid PE) binaries, which are incompatible with Hotpatch. 💡 Note: Hotpatch support for ARM64 devices is currently in Public Preview. CHPE must be disabled for Hotpatch updates to apply successfully.
-
web:learn.microsoft.com
Learn how to use the Vulnerability Remediation Agent in Microsoft Intune to identify, prioritize, and remediate security vulnerabilities across your managed devices.
-
web:learn.microsoft.com
Learn about the Vulnerability Remediation Agent in Microsoft Intune, its prerequisites, how it works, and how to set it up. The agent uses AI to identify and prioritize vulnerability remediation based on Microsoft Defender Vulnerability Management data.
-
web:mrmicrosoft.com
Currently in public preview, the agent uses data from Microsoft Defender Vulnerability Management to identify Common Vulnerabilities and Exposures (CVEs) across managed Windows client devices and prioritize remediation . It considers factors such as CVSS severity, exposure impact, and affected device count to help administrators focus on critical risks first.
-
web:scloud.work
Troubleshoot Intune Remediation scripts locally: find them in the IMECache folder, run them manually, check the IME log and read results from the registry.
-
web:support.microsoft.com
Updates for Windows released on April 9, 2024, and later updates, add the following: Three new mitigation controls that replace the mitigations released in 2023. The new mitigations controls are: A control to deploy the "Windows UEFI CA 2023" certificate to the Secure Boot DB to add trust for Windows boot managers signed by this certificate.
-
web:techcommunity.microsoft.com
View eligibility prerequisites here. How the agent helps you identify and triage vulnerabilities The Vulnerability Remediation Agent uses data from Microsoft Defender Vulnerability Management to identify Common Vulnerabilities and Exposures (CVEs) across your Intune-managed Windows devices and apps, then prioritizes them for remediation .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.