996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06SHA-256 hash

Reported by 1 independent source · first reported 6 Oct 2026 by SANS Internet Storm Center · last reported 6 Oct 2026

Last reported 18 days ago

What the reports say

1 report, newest first · the exact sentence from each

“996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06 a1_sas_dll_file”

SANS Internet Storm CenterVendor6 Oct 2026
More RMM Tools In the Wild, (Tue, Oct 6th)

Indicators reported together

named in the same reports

hxxps://up-theta-rose.vercel[.]app/adobe_new_update.vbsin 1 report
up-theta-rose.vercel[.]appin 1 report
hxxps://up-theta-rose.vercel[.]app/action1.msiin 1 report
eaff35d250c9b04f…88ad43378727in 1 report
1b19115d5ebdc216…79f9f3b20342in 1 report
941695d20d82dd5d…e2cb6cb6e8e3in 1 report
hxxps://www.action1[.]com/remote-access/in 1 report

Copy these 7 indicators · defanged

7 indicators, defanged, one per line

hxxps://up-theta-rose.vercel[.]app/adobe_new_update.vbs
up-theta-rose.vercel[.]app
hxxps://up-theta-rose.vercel[.]app/action1.msi
eaff35d250c9b04f51c971e70082740dbfeee5dd846829d541f588ad43378727
1b19115d5ebdc216e0ab3adf2c643648cfc70a385f4caf0217c679f9f3b20342
941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
hxxps://www.action1[.]com/remote-access/

Thanks — we review every report.

Report a wrong value