e8f55d0f327fd1d5f26428b890ef7fe878e135d494acda24ef01c695a2e9136d

SHA-256 of the malicious `wsc.dll` PlugX loader from the border-hopping USB-worm variant attributed by Sophos X-Ops to PKPLUG / Mustang Panda. Listed in the IOC table of the March 2023 Sophos News disclosure and re-confirmed by Sekoia's September 2023 sinkholing report.

family

PlugX

first seen

Mar 8, 2023

publisher

Sophos X-Ops