TLP:WHITE26 IOCs

UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos

Synaptic Systems

Published June 27, 2026Original Report

Malware Families

Diamond Model

Adversary

Infrastructure

Capability(1)

Victim

5W+H Threat Analysis

Analysis unavailable

Indicators of Compromise

Indicators of Compromise26

Type	Indicator	Confidence	Score	First Seen
SHA256	93621d3793198cb00c1a0450e8e3375d6c0de862a8449ab796c894062ae32612 file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	198995fecc0e38a2749b7e48c54112a959b77878683b726ee36430c4bacec196 file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	bb40c9d8c217516a92a18a1bdb080a5af92cfafe81f6751dea665e3e78cb4851 aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8 file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	4870337bcd6e3ba0d82ca6a42604c05f1885c87967d0dc120f699d2b19706247 aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	ad17e13f05399f0c3a2b13505507a78d8c2dbe2850e507a2d78b9dfa2f5b5e9a file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	a8d0a03543db29d279175c9679eba574dcb7a17e306195a68ab1d033ee2be01c aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	fe38e54bedee074825eb3fcbe4824ed203876692a424e0c183e0006b31d1b7a8 aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	b02b8547644bbfe77428e59c5ccec56c412e3c83aec44180e59110189a249956 file-hashintel-blogloader	High	86	Jun 27, 26
SHA256	fee96a66a8c143ff4f172963a56a813427a65dad7758834bb3283685a37df633 aptespionagefile-hash	High	86	Jun 27, 26
SHA256	c74bb6fb848cdb87c2b4261da1efc078023cdf95aa7b1436c52c26f3a11025af file-hashintel-blogmalware	High	86	Jun 24, 26
SHA256	56b19b9f63a649e8cfb9a0e4bb73aac52fbc2265e9793a5b976221432d0ba77f file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	8e8e43a2f0069f081f5ffb77237faebcda9a46e8f8fd0e128500e74bbc9ea3a5 file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	86bac1444fef0b07eec10dcd4a5859a2296954f6b5a36690dc7c27e2931b9ccc aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	3594a835ed3dbf80ac460c0e852fa91baa3b17aadff9c3b40c03eff6b34658d2 file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	a11339f52a3b31d5a1f134e19bfc83d260ccbde4f14b14889bd824cc636c9a93 aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	6754f3854680767a394b22090f277fc53ec5a242faff54bf233084da5989c3ef aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	95c8f0ac2e427a5637e554c60f649cab1fe55f649fe3aacde3c66fdc6491921b file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	40079f05ba7cdccac1f62f8e7e1b644bc0a806b58465f5c005725bc54ee73ef1 aptespionageexploit	High	86	Jun 27, 26
SHA256	324e2f2241604e53b88bd590213385abbb2961d3f17debfb4d40e4fa7bd9c4c0 file-hashintel-blogloader	Medium	53	Jun 27, 26
SHA256	729e5965e43ff458f6da901536c9a43be52a3820718e2dd5456150e2d73bb97f file-hashintel-blogmalware	Medium	53	Jun 27, 26
SHA256	da48273d7d4ab1d71ecf50fec0a58884ddb2baf18d872f25cab3637519ef71d7 aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	43579dd80314b6de4a1ca4e40b53ef0376a2ab55d50c8368e0b26af0af0d08c7 aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	adf2c6f80229677615358b56f329aba9c3e9e009d9ca6d6deb0b805e6e212dbc aptespionagefile-hash	Medium	53	Jun 27, 26
SHA256	c0713fd808170f2204a9bc091288e358c5f3266bf99a44f3a36a7ccc03732bb1 aptespionagefile-hash	Medium	53	Jun 27, 26

IOC Relationship Graph

IOC Relationship Graph26 total IOCs

SHA256

scroll to zoom · drag to pan · click IOC to open