IOC Radar
SHA256MediumSignal 95/100

6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b

Location
Iran, Islamic Republic ofIran, Islamic Republic of
First Seen
Oct 3, 2025
Last Seen
May 12, 2026
Oct 3
First Seen
269d ago
May 12
Last Seen
48d ago
12
Reports
source reports
95%
Confidence
medium
Found in 12 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
95%
Signal Score
95 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

53 techniques

Feed Intelligence Summary

12 reports95% confidence
12
Source reports
95%
Confidence score
Category tags
abuseacademic institutionsaccommodation and food servicesaccommodation servicesactive scanagendaagendacryptai applicationsai researchai securityai solutionsai useai-enabled cybercrimeai-powered cybercrimeaisurualienvault_ransomwareapplication developmentapt groupsartificial intelligenceasiaastaroth banking malwareautomotive manufacturingbad reputationbeaconbecbotnetbotnet activitybpfdoorbrute forcebusiness servicescanadacanoncanon breachchinacisacivil servicescl0pclopclop groupclop ransomwarecloud infrastructurecobalt strikecommand & controlcommand and controlcommand executioncommunication technologiescommunity managementcompoodcomputer visionconsumer goodscontent sharingcorporate lawcredential accesscredential harvestingcredential stuffingcritical patchcritical severitycvss versioncvss:9.8cyber threatsdata encryptiondata exfiltrationdata store exposureddosddos attacksdeep learningdevelopment methodologiesdevopsdigital mediadigital platformsdistributed attacksdistribution managementeducational resourceseducational serviceseducational technologyelectronic health recordselectronics manufacturingencryptionenergyenergy distributionentertainment technologyetherrateuropeeurope/asiaexploitexploitation activityextortionfigurefile-hashfinancefinancial servicesfleet managementfood servicesfreight forwardingfreight servicesgafgytgengeneratorgenesisgitlabgovernment technologyguest serviceshashhealth care and social assistancehealth information technologyhealthcare information systemshigher educationhospital managementhospitality technologyhotelsidentity & access exploitationimpactindicatorindustrial automationindustrial iotindustrial productioninformation technologyinfostealerinjection activityintellectual property lawinterlockinternet of thingsinventory managementiot botnetiot securityiot/ics attackiranislamic republic ofit infrastructurejapank-12 educationkodadrlaw practicelegal consultinglegal researchlegal serviceslegal technologylinuxllmslogistics technologylzrdmachine learningmacosmalicious powershell activitymalicious softwaremalwaremalware campaignmanagement consultingmanufacturing technologymaritime transportmasutamatrixmazemaze ransomwaremedia & entertainmentmedia and entertainmentmedia distributionmedical servicesmiorimirai botnetmobile carriersmobile networksmonetastealermortemultimedia productionnatural language processingnetherlandsnezhanoodle ratnorth americaoil & gasokiruoracleoracle e-business suiteoracle ebsparaguaypassenger transportationpatchpatch availablepatient carephishingphishing attackpower generationpower systemspremier supportprocess injectionprocess manufacturingproduct developmentprofessional servicespublic administrationpublic infrastructurepublic policypythonpython scriptqilinquality assurancequality controlrail transportransomransomwareratrcereactregulatory agenciesregulatory complianceremote code executionrenewable energyresearchedresgodrestaurant operationsretail traderiskrisk matrixromaniarondorondobotrussiasatoriscriptscripting attackssecurity alertsecurity alertssecurity operationsshipping servicessliversocial analyticssocial engineeringsocial mediasocial media marketingsocial media securitysocial networkingsoftware architecturesoftware developmentsoftware engineeringsoftware testingsourcestealit ratstreaming servicessuitesupply chainsupply chain attacksupply chain managementsuspsystem disruptiont1005t1021t1027t1047t1053t1055t1056t1059t1059.001t1059.006t1059_004t1068t1071t1071.001t1072t1074t1078t1086t1090t1102t1106t1113t1133t1190t1192t1203t1204t1204.001t1204.002t1210t1219t1486t1490t1496t1498t1499.001t1499.002t1499.003t1505.003t1555t1560t1565t1566t1566.001t1566.002t1566.003t1567t1569.002t1588t1588.001t1588.005t1588.006t1592t1595technology hardwaretelecom servicestelecommunicationsthreatthreat actorthreat intelligencetor nodetorlustourismtransportation and warehousingtransportation infrastructuretransportation managementtransportation technologyunauthenticated accessunitunited statesuser engagementvshellvulnerabilityvulnerability scanwarehouse operationswarlock ransomwarewickedwormgptwritexmrigzero-day exploitationzeroday exploit

Activity Timeline

1 total obs
May 12May 12

Threat Activity Heatmap

· Peak: 2026-05-12
Less
More
Mon
Wed
Fri
Jun
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreHigh Risk
95
SIGNAL
Signal Score
95%
Confidence
12
Reports
First seenOct 3, 2025
Last seenMay 12, 2026

VirusTotal

Not checked

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 8 months ago · Last seen 1 month ago
Appeared in 12 threat reports