3d9d7a7905e46a3e39a45405cb010c1baa735f9e

SHA1 Hash

Threat entity extracted from intelligence sources

Frequency

5

occurrences

First Seen

March 26, 2026

Last Seen

April 2, 2026

IOC Validation

ThreatCluster AI

Confirmed IOC — High confidence

Listed as a likely follow-up payload file hash

This indicator was confirmed as a true IOC by AI analysis.

Pivot to external tools

Opens in new tab · no data sent to TC

Reputation · 2

Sandbox · 4

Hybrid Analysis

Malware trackers · 3

Web search · 2

Related Clusters (2)

Evolution of Chinese-Nexus Cyber Operations: Strategic Long-Term Threats

Apr 2·255 sources

GhostSocks Malware: A Growing Threat Utilizing Residential Proxies

Mar 26·4 sources

Related Articles (5)

How Chinese-Nexus Cyber Operations Have Evolved

Darktrace·Apr 2

How Chinese-Nexus Cyber Operations Have Evolved

Darktrace·Apr 2

How Chinese-Nexus Cyber Operations Have Evolved

Darktrace·Apr 2

Tracking & Detecting GhostSocks Malware

Darktrace·Mar 26

Tracking & Detecting GhostSocks Malware

Darktrace·Mar 26

Related Entities

Malware Phishing Ransomware Data Breach Azure Education GhostSocks Lumma Stealer T1041 - Exfiltration Over C2 Channel T1571 - Non-Standard Port T1071 - Application Layer Protocol T1090 - Proxy