e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382eSHA-256 hash
Reported by 3 independent sources · first reported by Microsoft Security Blog · last reported
Last reported 26 days agoFeeds last saw it 19 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks“SHA-256: e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e (first-stage loader WinSparkle.dll, first seen May 21, 2026)”
-
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations“In the analyzed sample, the loader DLL was named WinSparkle.dll (SHA-256: e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e) and its file archive was named WinSparkle (SHA-256: 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef).”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch MalwareBazaar | 1 | — |
Indicators reported together
named in the same reports- 9cb68f986043a576…ed1c13f077efin 2 reports
- c82520eb03c08422…a96afe71ef77in 2 reports
- corp.tripswithengine[.]comin 2 reports
- hxxps://winsparkle[.]org/in 1 report
- winsparkle[.]orgin 1 report
- hxxps://poedit[.]com/in 1 report
- poedit[.]comin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.