2b6cdafdfe427a3de1a94a8a2ca1f09fc4c8f90e4f59089fd9b35b73185ed01cSHA-256 hash
Reported by 1 independent source · first reported by Fortinet Threat Research · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
QuickFox Supply Chain Attack Used to Deploy FDMTP Implant“Analysis of the generation 1 version of the ‘Microsoft.ServiceHosting.Tools.dll’ file (SHA256:2B6CDAFDFE427A3DE1A94A8A2CA1F09FC4C8F90E4F59089FD9B35B73185ED01C) identifies it as a .NET loader containing an embedded .NET module payload ‘Client.dll’ stored as a byte array.”
Indicators reported together
named in the same reports- cdns3.51quickfox[.]comin 1 report
- 51quickfox[.]cnin 1 report
- domain51quickfox.comcdns3.51quickfox[.]cnin 1 report
- hxxp://cdns3.51quickfox[.]cn/2025090411/update.zip%E2%80%99in 1 report
- cdns3.51quickfox[.]cnin 1 report
- 795594ad5e6f2868…de9a98528fb9in 1 report
- www.icloud-cdn[.]netin 1 report
- www.google-apis.netwww.google-apis[.]netin 1 report
- www.google-apis[.]netin 1 report
- www.icloud-cdn.netwww.icloud-cdn[.]netin 1 report
- www.wangmeng.xyzwww.wangmeng[.]xyzin 1 report
- www.wangmeng[.]xyzin 1 report
- www.wangmengsb.comwww.wangmengsb[.]comin 1 report
- www.wangmengsb[.]comin 1 report
- www.wangmeng66.topwww.wangmeng66[.]topin 1 report
- www.wangmeng66[.]topin 1 report
- www.techcheck1.comwww.techcheck1[.]comin 1 report
- www.techcheck1[.]comin 1 report
- 47.238.64.56www.yahoo-cdn[.]itin 1 report
- 47.239.4.179www.wangmengsb[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.