IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE13 IOCs

Hirudo: From Fake Updates to Patched Banking Apps

TH
ThreatFabric
Published October 14, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYPlayINFRASTRUCTURE18.139.79.161www.helloharmonyos.com134.122.153.68CAPABILITYMETA StealerPlayVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability(2)
Victim

Indicators of Compromise

Indicators of Compromise13

TypeIndicatorConfidenceScoreFirst Seen
IP18.139.79.161
exploitintel-blogmalware
High
58
Oct 15, 26
SHA256425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83
file-hashintel-blogloader
Medium
53
Oct 15, 26
SHA256d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d
file-hashintel-blogloader
Medium
53
Oct 15, 26
SHA256f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248
file-hashintel-blogloader
Medium
53
Oct 15, 26
SHA256b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99
file-hashintel-blogloader
Medium
53
Oct 15, 26
Domainwww.helloharmonyos.com
intel-blogmalwarenetwork
High
58
Oct 15, 26
IP134.122.153.68
exploitintel-blogmalware
High
58
Oct 15, 26
SHA2560097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7
file-hashintel-blogloader
Medium
53
Oct 15, 26
IP134.122.153.136
intel-blogmalwarenetwork
High
58
Oct 15, 26
URLhttp://43.225.157.157:8766/request_token
intel-blogmalwarenetwork
High
58
Oct 15, 26
IP134.122.153.92
exploitintel-blogmalware
High
58
Oct 15, 26
SHA2562e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b
file-hashintel-blogloader
Medium
53
Oct 15, 26
Domainjiekou.baojingtextile.cn
intel-blogmalwarenetwork
High
58
Oct 15, 26

IOC Relationship Graph

IOC Relationship Graph13 total IOCs
IPSHA256DomainURL
SHA2566IP4Domain2URL1Actors1Malware2REPORTHirudo: From Fake Updates PlayMETA StealerPlay
scroll to zoom · drag to pan · click IOC to open