c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77SHA-256 hash
Reported by 2 independent sources · first reported by Microsoft Security Blog · last reported
Last reported 26 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks“SHA-256: c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 (encrypted archive named libcurl, older version, first seen October 3, 2025)”
-
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations“An older version of the malware, for example, used a libcurl (SHA-256: c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77) file archive, and it contained only four files:”
Indicators reported together
named in the same reports- e842dd7642c8e04b…fe7800ba382ein 2 reports
- 9cb68f986043a576…ed1c13f077efin 2 reports
- corp.tripswithengine[.]comin 2 reports
- hxxps://winsparkle[.]org/in 1 report
- winsparkle[.]orgin 1 report
- hxxps://poedit[.]com/in 1 report
- poedit[.]comin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.