RozenaMalware

Last reported 16 days ago, by Cisco Talos1 report

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

“…f scripts CAIRN tracks as ROZESHELL combines this AI-evasion comment with AMSI bypass capability, runtime compilation via csc.exe, and a Rozena shellcode loader.”

Cisco TalosVendor8 Oct 2026
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

Indicators in its reports

named in the reports above

f8f5e0440c57c7de…96a379188a7din 1 report
34098fe0bc4c69c4…4c28c113b5c3in 1 report
389066bd5543aeea…9f594cf48ecfin 1 report
5f60d16fa67ff8ef…5c56e076e259in 1 report
a0294f7152f9c4c9…949f26a15cc8in 1 report
c17bf76d02163863…5e0469ca269fin 1 report
2aa7f13bf474e2ce…65255241c937in 1 report
bacb5794a300f7a8…afe8588fc33fin 1 report
2e3e1bcd44cc3cbe…9b5f7e1ae6abin 1 report
a42632c68d2dcea0…d2774eacf433in 1 report
7dd3747d777f9576…ac41479d199ain 1 report

Copy these 11 indicators · defanged

11 indicators, defanged, one per line

f8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d
34098fe0bc4c69c4c4eb3f74688fb375326804536d25e5574e8c4c28c113b5c3
389066bd5543aeea363d23a4dce7f7a21c7f2c73c61f506a93a69f594cf48ecf
5f60d16fa67ff8ef07817c33b7e6b7fa91c6c21060020df46b1f5c56e076e259
a0294f7152f9c4c908e9def58279e9fa29952715947c950c8489949f26a15cc8
c17bf76d02163863c251c3bb3a12725eeb525fab5522521923925e0469ca269f
2aa7f13bf474e2ce5049fd4db2bf4da04b4ce51ac0d36dceb24865255241c937
bacb5794a300f7a88c7f6d458382eb11d2f39c0f496b509ca512afe8588fc33f
2e3e1bcd44cc3cbec4f5ca9991d14a326d3cc6bf76fe6e0d434c9b5f7e1ae6ab
a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433
7dd3747d777f9576a11004532b463351e7718b6af193d8ee7221ac41479d199a

Thanks — we review every report.

Report a wrong match