Trusted Design

The return of HackingTeam with new implants for OS X

概要

Last week, Patrick Wardle published a very nice analysis of a new Backdoor and Dropper used by HackingTeam, which is apparently alive and well. Since HackingTeam implants are built on-demand for each target, we wanted to take a closer look: to see how it works and what its functionality reveals about the possible interest of the attackers behind this latest Backdoor.

Created: 2026-02-23

Indicators

• FileHash-SHA1 - b7ec5d36ca702cc9690ac7279fd4fea28d8bd060 -
• YARA - 1b6f43d87c1333b4de650e89a469ab063cf179e0 -
• YARA - b3bc003e863814618804083bb87dd5d0fc699d76 -
• YARA - e66657036a006065b0ce9a299092832015aab6a0 -
• FileHash-SHA256 - 40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c -
• FileHash-MD5 - e2b81bed4472087dca00bee18acbce04 -
• FileHash-SHA256 - a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01 -
• YARA - 59e7b64b578c0aa3252e014c7633073372a70f23 -
• FileHash-SHA256 - 92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d -
• YARA - a79eb3523b6c5f53037178ae982e2b8b8f185f72 -
• FileHash-SHA256 - 9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1 -
• FileHash-MD5 - 0eb73f2225886fd5624815cd5d523d08 -
• FileHash-SHA1 - cf5089752ba51ae827971272a5b761a4ab0acd84 -

類似Pulses

• Skygofree: Following in the footsteps of HackingTeam (score: 0.58)
• HackTool:Win32/Keylogger (score: 0.58)
• OS X Gatekeeper exploit (score: 0.57)
• BlackEnergy by the SSHBearDoor (score: 0.57)
• Worm:Win32/Macoute (score: 0.56)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る