1613a913d0384cbb958e9a8d6b00fffaf77c27d348ebc7886d6c563a6f22f2b7SHA-256 hash

Reported by 1 independent source · first reported 15 Nov 2025 by Elastic Security Labs · last reported 15 Nov 2025

Last reported 11 months ago

What the reports say

1 report, newest first · the exact sentence from each

“| 1613a913d0384cbb958e9a8d6b00fffaf77c27d348ebc7886d6c563a6f22f2b7 | SHA-256 | tp.png | Stage 2 - encrypted core payload |”

Elastic Security LabsVendor15 Nov 2025
RONINGLOADER: DragonBreath’s New Path to PPL Abuse

Indicators reported together

named in the same reports

da2c58308e860e57…3c434283d50bin 1 report
82794015e2b40cc6…0edaee203724in 1 report
c65170be2bf4f0bd…959bcaad8ae5in 1 report
2515b546125d2001…9a77a32c54f5in 1 report
395f835731d25803…59af32f6258din 1 report
1c1528b546aa29be…9f22a4ee37e2in 1 report
4d5beb8efd4ade58…35a756ed39e6in 1 report
96f401b80d3319f8…39bcfb07cdf0in 1 report
33b494eaaa6d7ed7…52c3313e617cin 1 report
fc63f5dfc93f2358…f6041a0e01bcin 1 report
fd4dd9904549c665…252001f1d107in 1 report
3dd470e85fe77cd8…87ca2fd24e33in 1 report
qaqkongtiao[.]comin 1 report
hxxps://nsis.sourceforge[.]io/Main_Pagein 1 report
hxxps://github[.]com/Jemmy1228/HookSigntoolin 1 report
hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/in 1 report
www.safebreach[.]comin 1 report
hxxps://hijacklibs[.]net/entries/microsoft/built-in/wow64log.htmlin 1 report
hijacklibs[.]netin 1 report
hxxps://en.wikipedia[.]org/wiki/Fowler%E2%80%93Noll%E2%80%93Vo_hash_functionin 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

da2c58308e860e57df4c46465fd1cfc68d41e8699b4871e9a9be3c434283d50b
82794015e2b40cc6e02d3c1d50241465c0cf2c2e4f0a7a2a8f880edaee203724
c65170be2bf4f0bd71b9044592c063eaa82f3d43fcbd8a81e30a959bcaad8ae5
2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5
395f835731d25803a791db984062dd5cfdcade6f95cc5d0f68d359af32f6258d
1c1528b546aa29be6614707cbe408cb4b46e8ed05bf3fe6b388b9f22a4ee37e2
4d5beb8efd4ade583c8ff730609f142550e8ed14c251bae1097c35a756ed39e6
96f401b80d3319f8285fa2bb7f0d66ca9055d349c044b78c27e339bcfb07cdf0
33b494eaaa6d7ed75eec74f8c8c866b6c42f59ca72b8517b3d4752c3313e617c
fc63f5dfc93f2358f4cba18cbdf99578fff5dac4cdd2de193a21f6041a0e01bc
fd4dd9904549c6655465331921a28330ad2b9ff1c99eb993edf2252001f1d107
3dd470e85fe77cd847ca59d1d08ec8ccebe9bd73fd2cf074c29d87ca2fd24e33
qaqkongtiao[.]com
hxxps://nsis.sourceforge[.]io/Main_Page
hxxps://github[.]com/Jemmy1228/HookSigntool
hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/
www.safebreach[.]com
hxxps://hijacklibs[.]net/entries/microsoft/built-in/wow64log.html
hijacklibs[.]net
hxxps://en.wikipedia[.]org/wiki/Fowler%E2%80%93Noll%E2%80%93Vo_hash_function

Thanks — we review every report.

Report a wrong value