9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077efSHA-256 hash
Reported by 2 independent sources · first reported by Microsoft Security Blog · last reported
Last reported 26 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks“SHA-256: 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef (encrypted archive named WinSparkle, first seen May 23, 2026)”
-
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations“…c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e) and its file archive was named WinSparkle (SHA-256: 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef).”
Indicators reported together
named in the same reports- e842dd7642c8e04b…fe7800ba382ein 2 reports
- c82520eb03c08422…a96afe71ef77in 2 reports
- corp.tripswithengine[.]comin 2 reports
- hxxps://winsparkle[.]org/in 1 report
- winsparkle[.]orgin 1 report
- hxxps://poedit[.]com/in 1 report
- poedit[.]comin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.