QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

    Wednesday, August 5, 2026 In: Threat Research Print

    Date: 08/05/2026

    Severity: High

    Summary

    ThreatLabz is tracking a long-running supply chain attack involving the QuickFox application, a VPN proxy and game accelerator popular among Chinese users. The campaign has been active since at least August 2025 and relies on a trojanized version of the software. Attackers modified an Electron renderer HTML file to download and execute a JavaScript-based loader. The loader fingerprints the victim system to verify it as a valid target before deploying the FDMTP implant. Researchers observed ongoing infrastructure activity, indicating the campaign is still under active development. Following responsible disclosure, QuickFox removed the malicious Windows installer components in version 3.59.6, preventing further infection progression.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    cdns3.51quickfox.cn

    cdns3.51quickfox.cn/2025090411/update.zip

    cdns3.51quickfox.cn/script/firebase-app-compat.js

    cdns3.51quickfox.cn/script/firebase-analytics-compat.js

    www.icloud-cdn.net

    www.icloud-cdn.net:8080/GetCluster

    www.icloud-cdn.net:8080/GetSlaver

    www.icloud-cdn.net/checksum.bin

    www.icloud-cdn.net/dnscfg.dll

    www.icloud-cdn.net/Client.dll

    www.icloud-cdn.net/vshost.exe

    www.google-apis.net

    www.google-apis.net/dfsvc.exe

    www.google-apis.net/dfsvc.exe.config

    www.google-apis.net/wangmeng.dll

    www.techcheck1.com

    www.techcheck1.com/GetPeers

    www.techcheck1.com/GetClusterNodes

    www.techcheck1.com/vshost.exe

    www.techcheck1.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll

    www.techcheck1.com/config.etl

    www.techcheck1.com/dfsvc.exe.config

    www.techcheck1.com/wangmeng.dll

    www.yahoo-cdn.it.com

    www.yahoo-cdn.it.com/dfsvc.exe.config

    www.yahoo-cdn.it.com/dnscfg.dll

    www.yahoo-cdn.it.com/GetCluster

    www.yahoo-cdn.it.com/vshost.exe

    www.yahoo-cdn.it.com/dfsvc.exe

    www.yahoo-cdn.it.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll

    www.yahoo-cdn.it.com/config.etl

    www.wangmeng.xyz

    www.wangmeng.xyz/GetVips

    www.wangmeng.xyz/GetPeers

    www.wangmeng.xyz/GetAgents

    www.wangmeng.xyz/GetEndpoints

    www.wangmeng.xyz/GetInstances

    www.wangmeng.xyz/GetMachines

    www.wangmeng.xyz/GetMembers

    www.wangmeng.xyz/GetNodes

    www.wangmeng.xyz/GetReplicas

    www.wangmeng.xyz/GetRoutes

    www.wangmeng.xyz/GetServers

    www.wangmeng.xyz/GetTargets

    www.wangmeng.xyz/GetWorkers

    www.wangmengsb.com

    www.wangmengsb.com/GetAddresses

    www.wangmengsb.com/GetAgents

    www.wangmengsb.com/GetBackends

    www.wangmengsb.com/GetHosts

    www.wangmengsb.com/GetServers

    www.wangmengsb.com/GetIps

    www.wangmengsb.com/GetNodes

    www.wangmengsb.com/GetPeers

    www.wangmengsb.com/GetReplicas

    www.wangmengsb.com/GetRoutes

    www.wangmengsb.com/GetVips

    www.wangmengsb.com/GetWorkers

    www.wangmeng66.top

    www.wangmeng66.top/GetAddresse

    www.wangmeng66.top/GetEndpoints

    www.wangmeng66.top/GetHosts

    www.wangmeng66.top/GetInstances

    www.wangmeng66.top/GetMachines

    www.wangmeng66.top/GetPeers

    www.wangmeng66.top/GetProxies

    www.wangmeng66.top/GetReplicas

    www.wangmeng66.top/GetResources

    www.wangmeng66.top/GetRoutes

    www.wangmeng66.top/GetServers

    www.wangmeng66.top/GetTargets

    www.wangmeng66.top/GetWorkers

    IP Address 

    172.67.157.196

    104.21.89.96

    47.76.92.73

    47.83.122.51

    170.33.128.5

    47.86.14.22

    154.223.54.159

    154.223.24.158

    172.67.144.222

    104.21.39.112

    172.67.197.227

    104.21.44.82

    172.67.210.148

    104.21.37.164

    172.67.135.248

    104.21.7.138

    172.67.143.103

    104.21.95.64

    103.231.15.135

    45.125.15.104

    45.125.35.229

    45.125.35.233

    45.125.15.114

    103.231.15.248

    45.125.15.115

    123.254.105.38

    45.125.35.227

    45.125.35.235

    45.125.35.226

    45.125.35.234

    202.181.25.73

    103.246.244.13

    103.246.244.20

    45.125.35.236

    103.231.15.219

    43.240.12.34

    45.125.35.225

    123.254.106.148

    45.125.15.100

    45.125.35.230

    45.125.35.231

    43.240.12.35

    45.125.15.111

    45.125.35.232

    202.181.25.71

    154.223.75.206

    154.223.58.142

    47.238.240.219

    154.223.58.64

    45.158.180.250

    47.238.64.56

    47.239.93.49

    38.60.142.56

    47.239.4.179

    47.88.21.252

    Hash  

    3B79D95F7F7B58C401A3BC79F94EBB52

    03FD832B81DD54D2BF5F610A8FF27856

    2DD8681DCD218C88D1C78DFE939EC92B

    2FFDCFB7157511789228988E26D06FD6

    5E4ED6ABBF555E5A542E3D4308CCD7BF

    19E760EE849EB7C1F100F2B7010A763D

    1F3031167F94B166CC7B69376A01C124

    30D59C3D4916AA5FB24050C6AAE7F8E4

    E0A92209DD62DAE8460D934DC6B7DDD7

    B1D344C9A1525373BE6A3980FA85A603

    5F3DAF7417DD666213168EB6C7453CC7

    173DD4190740B96F6F733C801B6428ED4B52B607

    7AB7FFE4C233A4F2440F0FDEB2E117C788792281

    C41B4E11E6A9E3B53DA1F92B213DE9F65A825C92

    39504CEAD410056878962053F8D027E9F299CD10

    B370B674CE877B9C0A7708C7834AEB7EDA983564

    3449A349B6C8045B16DF4F88D58C65C2BDF891BB

    B194A997C9A653134BDB1F2D0C3137DCDACB54D5

    A195810C41F401C4B48CB557CF8CE60C2D807025

    2CC0425A90A39AC4EEDADD59CAAAFAD5B50F8420

    11A6DF1E15663AE89F59A9E598AE8987F42A632B

    E90D2730F3354FF1ADF334B03C95EAC3207D47B9

    2B6CDAFDFE427A3DE1A94A8A2CA1F09FC4C8F90E4F59089FD9B35B73185ED01C

    795594AD5E6F2868CC4D8ED12DABF4F3999A1477C6B250527C5EDE9A98528FB9

    6634339B813E6105B5138DE6AB67B016B8DFBF49233C29DE9BAB3207E8B50D24

    A5D36EDC34FE54B2092349F877DAF560A98F5FEA635D1AC4A110B3518102EF96

    DC666E9C148BBCA5E21D8C9A97143575C075F53360F135E0191AED9E8278D396

    5CBB64375636E83B5F17D6083633CECC02E2A5F4168CD7CCA5CDEE36CCCA9B38

    A53D756F28457B1C4A239C91CDEC8ED7B7DA67A93E332E6DF9621CBEF8417474

    D9DB5CBC193DDAF4C0A265804FDEF70C32451DAAF2974FA9ADF52CE1DEFAC5F7

    7462CE2595119C928CF516EC33148DC2A39DD9F71636A5C849C7ED93B7C5CA06

    3BD3B300F3278520819A06D0CB1F0EADBF946DBBC11352538246FF075EB427F1

    6932A20AC61FD3F93D7CFEE414F6F46834068AC7C9CA011B054A6A10DC56B3D1

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "www.wangmeng.xyz" or url like "www.wangmeng.xyz" or siteurl like "www.wangmeng.xyz" or domainname like "www.wangmengsb.com" or url like "www.wangmengsb.com" or siteurl like "www.wangmengsb.com" or domainname like "www.yahoo-cdn.it.com" or url like "www.yahoo-cdn.it.com" or siteurl like "www.yahoo-cdn.it.com" or domainname like "cdns3.51quickfox.cn" or url like "cdns3.51quickfox.cn" or siteurl like "cdns3.51quickfox.cn" or domainname like "www.techcheck1.com" or url like "www.techcheck1.com" or siteurl like "www.techcheck1.com" or domainname like "www.icloud-cdn.net" or url like "www.icloud-cdn.net" or siteurl like "www.icloud-cdn.net" or domainname like "www.google-apis.net" or url like "www.google-apis.net" or siteurl like "www.google-apis.net" or domainname like "cdns3.51quickfox.cn" or url like "cdns3.51quickfox.cn" or siteurl like "cdns3.51quickfox.cn" or domainname like "cdns3.51quickfox.cn/2025090411/update.zip" or url like "cdns3.51quickfox.cn/2025090411/update.zip" or siteurl like "cdns3.51quickfox.cn/2025090411/update.zip" or domainname like "cdns3.51quickfox.cn/script/firebase-app-compat.js" or url like "cdns3.51quickfox.cn/script/firebase-app-compat.js" or siteurl like "cdns3.51quickfox.cn/script/firebase-app-compat.js" or domainname like "cdns3.51quickfox.cn/script/firebase-analytics-compat.js" or url like "cdns3.51quickfox.cn/script/firebase-analytics-compat.js" or siteurl like "cdns3.51quickfox.cn/script/firebase-analytics-compat.js" or domainname like "www.icloud-cdn.net" or url like "www.icloud-cdn.net" or siteurl like "www.icloud-cdn.net" or domainname like "www.icloud-cdn.net:8080/GetCluster" or url like "www.icloud-cdn.net:8080/GetCluster" or siteurl like "www.icloud-cdn.net:8080/GetCluster" or domainname like "www.icloud-cdn.net:8080/GetSlaver" or url like "www.icloud-cdn.net:8080/GetSlaver" or siteurl like "www.icloud-cdn.net:8080/GetSlaver" or domainname like "www.icloud-cdn.net/checksum.bin" or url like "www.icloud-cdn.net/checksum.bin" or siteurl like "www.icloud-cdn.net/checksum.bin" or domainname like "www.icloud-cdn.net/dnscfg.dll" or url like "www.icloud-cdn.net/dnscfg.dll" or siteurl like "www.icloud-cdn.net/dnscfg.dll" or domainname like "www.icloud-cdn.net/Client.dll" or url like "www.icloud-cdn.net/Client.dll" or siteurl like "www.icloud-cdn.net/Client.dll" or domainname like "www.icloud-cdn.net/vshost.exe" or url like "www.icloud-cdn.net/vshost.exe" or siteurl like "www.icloud-cdn.net/vshost.exe" or domainname like "www.google-apis.net" or url like "www.google-apis.net" or siteurl like "www.google-apis.net" or domainname like "www.google-apis.net/dfsvc.exe" or url like "www.google-apis.net/dfsvc.exe" or siteurl like "www.google-apis.net/dfsvc.exe" or domainname like "www.google-apis.net/dfsvc.exe.config" or url like "www.google-apis.net/dfsvc.exe.config" or siteurl like "www.google-apis.net/dfsvc.exe.config" or domainname like "www.google-apis.net/wangmeng.dll" or url like "www.google-apis.net/wangmeng.dll" or siteurl like "www.google-apis.net/wangmeng.dll" or domainname like "www.techcheck1.com" or url like "www.techcheck1.com" or siteurl like "www.techcheck1.com" or domainname like "www.techcheck1.com/GetPeers" or url like "www.techcheck1.com/GetPeers" or siteurl like "www.techcheck1.com/GetPeers" or domainname like "www.techcheck1.com/GetClusterNodes" or url like "www.techcheck1.com/GetClusterNodes" or siteurl like "www.techcheck1.com/GetClusterNodes" or domainname like "www.techcheck1.com/vshost.exe" or url like "www.techcheck1.com/vshost.exe" or siteurl like "www.techcheck1.com/vshost.exe" or domainname like "www.techcheck1.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll" or url like "www.techcheck1.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll" or siteurl like "www.techcheck1.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll" or domainname like "www.techcheck1.com/config.etl" or url like "www.techcheck1.com/config.etl" or siteurl like "www.techcheck1.com/config.etl" or domainname like "www.techcheck1.com/dfsvc.exe.config" or url like "www.techcheck1.com/dfsvc.exe.config" or siteurl like "www.techcheck1.com/dfsvc.exe.config" or domainname like "www.techcheck1.com/wangmeng.dll" or url like "www.techcheck1.com/wangmeng.dll" or siteurl like "www.techcheck1.com/wangmeng.dll"

    Detection Query 2 :

    domainname like "www.yahoo-cdn.it.com" or url like "www.yahoo-cdn.it.com" or siteurl like "www.yahoo-cdn.it.com" or domainname like "www.yahoo-cdn.it.com/dfsvc.exe.config" or url like "www.yahoo-cdn.it.com/dfsvc.exe.config" or siteurl like "www.yahoo-cdn.it.com/dfsvc.exe.config" or domainname like "www.yahoo-cdn.it.com/dnscfg.dll" or url like "www.yahoo-cdn.it.com/dnscfg.dll" or siteurl like "www.yahoo-cdn.it.com/dnscfg.dll" or domainname like "www.yahoo-cdn.it.com/GetCluster" or url like "www.yahoo-cdn.it.com/GetCluster" or siteurl like "www.yahoo-cdn.it.com/GetCluster" or domainname like "www.yahoo-cdn.it.com/vshost.exe" or url like "www.yahoo-cdn.it.com/vshost.exe" or siteurl like "www.yahoo-cdn.it.com/vshost.exe" or domainname like "www.yahoo-cdn.it.com/dfsvc.exe" or url like "www.yahoo-cdn.it.com/dfsvc.exe" or siteurl like "www.yahoo-cdn.it.com/dfsvc.exe" or domainname like "www.yahoo-cdn.it.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll" or url like "www.yahoo-cdn.it.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll" or siteurl like "www.yahoo-cdn.it.com/Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll" or domainname like "www.yahoo-cdn.it.com/config.etl" or url like "www.yahoo-cdn.it.com/config.etl" or siteurl like "www.yahoo-cdn.it.com/config.etl" or domainname like "www.wangmeng.xyz" or url like "www.wangmeng.xyz" or siteurl like "www.wangmeng.xyz" or domainname like "www.wangmeng.xyz/GetVips" or url like "www.wangmeng.xyz/GetVips" or siteurl like "www.wangmeng.xyz/GetVips" or domainname like "www.wangmeng.xyz/GetPeers" or url like "www.wangmeng.xyz/GetPeers" or siteurl like "www.wangmeng.xyz/GetPeers" or domainname like "www.wangmeng.xyz/GetAgents" or url like "www.wangmeng.xyz/GetAgents" or siteurl like "www.wangmeng.xyz/GetAgents" or domainname like "www.wangmeng.xyz/GetEndpoints" or url like "www.wangmeng.xyz/GetEndpoints" or siteurl like "www.wangmeng.xyz/GetEndpoints" or domainname like "www.wangmeng.xyz/GetInstances" or url like "www.wangmeng.xyz/GetInstances" or siteurl like "www.wangmeng.xyz/GetInstances" or domainname like "www.wangmeng.xyz/GetMachines" or url like "www.wangmeng.xyz/GetMachines" or siteurl like "www.wangmeng.xyz/GetMachines" or domainname like "www.wangmeng.xyz/GetMembers" or url like "www.wangmeng.xyz/GetMembers" or siteurl like "www.wangmeng.xyz/GetMembers" or domainname like "www.wangmeng.xyz/GetNodes" or url like "www.wangmeng.xyz/GetNodes" or siteurl like "www.wangmeng.xyz/GetNodes" or domainname like "www.wangmeng.xyz/GetReplicas" or url like "www.wangmeng.xyz/GetReplicas" or siteurl like "www.wangmeng.xyz/GetReplicas" or domainname like "www.wangmeng.xyz/GetRoutes" or url like "www.wangmeng.xyz/GetRoutes" or siteurl like "www.wangmeng.xyz/GetRoutes" or

    domainname like "www.wangmeng.xyz/GetServers" or url like "www.wangmeng.xyz/GetServers" or siteurl like "www.wangmeng.xyz/GetServers" or domainname like "www.wangmeng.xyz/GetTargets" or url like "www.wangmeng.xyz/GetTargets" or siteurl like "www.wangmeng.xyz/GetTargets" or domainname like "www.wangmeng.xyz/GetWorkers" or url like "www.wangmeng.xyz/GetWorkers" or siteurl like "www.wangmeng.xyz/GetWorkers" or domainname like "www.wangmengsb.com" or url like "www.wangmengsb.com" or siteurl like "www.wangmengsb.com" or domainname like "www.wangmengsb.com/GetAddresses" or url like "www.wangmengsb.com/GetAddresses" or siteurl like "www.wangmengsb.com/GetAddresses" or domainname like "www.wangmengsb.com/GetAgents" or url like "www.wangmengsb.com/GetAgents" or siteurl like "www.wangmengsb.com/GetAgents" or domainname like "www.wangmengsb.com/GetBackends" or url like "www.wangmengsb.com/GetBackends" or siteurl like "www.wangmengsb.com/GetBackends" or domainname like "www.wangmengsb.com/GetHosts" or url like "www.wangmengsb.com/GetHosts" or siteurl like "www.wangmengsb.com/GetHosts" or domainname like "www.wangmengsb.com/GetServers" or url like "www.wangmengsb.com/GetServers" or siteurl like "www.wangmengsb.com/GetServers" or domainname like "www.wangmengsb.com/GetIps" or url like "www.wangmengsb.com/GetIps" or siteurl like "www.wangmengsb.com/GetIps" or

    domainname like "www.wangmengsb.com/GetNodes" or url like "www.wangmengsb.com/GetNodes" or siteurl like "www.wangmengsb.com/GetNodes" or domainname like "www.wangmengsb.com/GetPeers" or url like "www.wangmengsb.com/GetPeers" or siteurl like "www.wangmengsb.com/GetPeers" or domainname like "www.wangmengsb.com/GetReplicas" or url like "www.wangmengsb.com/GetReplicas" or siteurl like "www.wangmengsb.com/GetReplicas" or domainname like "www.wangmengsb.com/GetRoutes" or url like "www.wangmengsb.com/GetRoutes" or siteurl like "www.wangmengsb.com/GetRoutes" or domainname like "www.wangmengsb.com/GetVips" or url like "www.wangmengsb.com/GetVips" or siteurl like "www.wangmengsb.com/GetVips" or domainname like "www.wangmengsb.com/GetWorkers" or url like "www.wangmengsb.com/GetWorkers" or siteurl like "www.wangmengsb.com/GetWorkers" or domainname like "www.wangmeng66.top" or url like "www.wangmeng66.top" or siteurl like "www.wangmeng66.top" or domainname like "www.wangmeng66.top/GetAddresse" or url like "www.wangmeng66.top/GetAddresse" or siteurl like "www.wangmeng66.top/GetAddresse" or domainname like "www.wangmeng66.top/GetEndpoints" or url like "www.wangmeng66.top/GetEndpoints" or siteurl like "www.wangmeng66.top/GetEndpoints" or domainname like "www.wangmeng66.top/GetHosts" or url like "www.wangmeng66.top/GetHosts" or siteurl like "www.wangmeng66.top/GetHosts" or domainname like "www.wangmeng66.top/GetInstances" or url like "www.wangmeng66.top/GetInstances" or siteurl like "www.wangmeng66.top/GetInstances" or domainname like "www.wangmeng66.top/GetMachines" or url like "www.wangmeng66.top/GetMachines" or siteurl like "www.wangmeng66.top/GetMachines" or domainname like "www.wangmeng66.top/GetPeers" or url like "www.wangmeng66.top/GetPeers" or siteurl like "www.wangmeng66.top/GetPeers" or domainname like "www.wangmeng66.top/GetProxies" or url like "www.wangmeng66.top/GetProxies" or siteurl like "www.wangmeng66.top/GetProxies" or domainname like "www.wangmeng66.top/GetReplicas" or url like "www.wangmeng66.top/GetReplicas" or siteurl like "www.wangmeng66.top/GetReplicas" or domainname like "www.wangmeng66.top/GetResources" or url like "www.wangmeng66.top/GetResources" or siteurl like "www.wangmeng66.top/GetResources" or domainname like "www.wangmeng66.top/GetRoutes" or url like "www.wangmeng66.top/GetRoutes" or siteurl like "www.wangmeng66.top/GetRoutes" or domainname like "www.wangmeng66.top/GetServers" or url like "www.wangmeng66.top/GetServers" or siteurl like "www.wangmeng66.top/GetServers" or domainname like "www.wangmeng66.top/GetTargets" or url like "www.wangmeng66.top/GetTargets" or siteurl like "www.wangmeng66.top/GetTargets" or domainname like "www.wangmeng66.top/GetWorkers" or url like "www.wangmeng66.top/GetWorkers" or siteurl like "www.wangmeng66.top/GetWorkers" 

    Detection Query 3 :

    dstipaddress IN ("45.125.15.114","104.21.37.164","47.83.122.51","45.125.35.230","47.76.92.73","45.125.35.232","154.223.24.158","45.125.35.236","47.239.93.49","45.158.180.250","45.125.35.225","170.33.128.5","123.254.105.38","154.223.75.206","43.240.12.35","103.231.15.135","202.181.25.71","45.125.15.111","172.67.197.227","45.125.15.100","47.239.4.179","172.67.143.103","172.67.135.248","103.246.244.13","104.21.44.82","104.21.95.64","45.125.15.104","154.223.58.142","104.21.39.112","45.125.15.115","154.223.58.64","47.238.240.219","103.231.15.219","172.67.157.196","104.21.7.138","172.67.210.148","45.125.35.233","104.21.89.96","103.246.244.20","43.240.12.34","45.125.35.227","202.181.25.73","45.125.35.234","45.125.35.229","47.238.64.56","47.86.14.22","172.67.144.222","103.231.15.248","45.125.35.235","47.88.21.252","154.223.54.159","45.125.35.231","123.254.106.148","38.60.142.56","45.125.35.226") or srcipaddress IN ("45.125.15.114","104.21.37.164","47.83.122.51","45.125.35.230","47.76.92.73","45.125.35.232","154.223.24.158","45.125.35.236","47.239.93.49","45.158.180.250","45.125.35.225","170.33.128.5","123.254.105.38","154.223.75.206","43.240.12.35","103.231.15.135","202.181.25.71","45.125.15.111","172.67.197.227","45.125.15.100","47.239.4.179","172.67.143.103","172.67.135.248","103.246.244.13","104.21.44.82","104.21.95.64","45.125.15.104","154.223.58.142","104.21.39.112","45.125.15.115","154.223.58.64","47.238.240.219","103.231.15.219","172.67.157.196","104.21.7.138","172.67.210.148","45.125.35.233","104.21.89.96","103.246.244.20","43.240.12.34","45.125.35.227","202.181.25.73","45.125.35.234","45.125.35.229","47.238.64.56","47.86.14.22","172.67.144.222","103.231.15.248","45.125.35.235","47.88.21.252","154.223.54.159","45.125.35.231","123.254.106.148","38.60.142.56","45.125.35.226")

    Detection Query 4 :

    md5hash IN ("2FFDCFB7157511789228988E26D06FD6","E0A92209DD62DAE8460D934DC6B7DDD7","03FD832B81DD54D2BF5F610A8FF27856","B1D344C9A1525373BE6A3980FA85A603","3B79D95F7F7B58C401A3BC79F94EBB52","2DD8681DCD218C88D1C78DFE939EC92B","5E4ED6ABBF555E5A542E3D4308CCD7BF","19E760EE849EB7C1F100F2B7010A763D","1F3031167F94B166CC7B69376A01C124","30D59C3D4916AA5FB24050C6AAE7F8E4","5F3DAF7417DD666213168EB6C7453CC7")

    Detection Query 5 :

    sha1hash IN ("11A6DF1E15663AE89F59A9E598AE8987F42A632B","39504CEAD410056878962053F8D027E9F299CD10","7AB7FFE4C233A4F2440F0FDEB2E117C788792281","2CC0425A90A39AC4EEDADD59CAAAFAD5B50F8420","173DD4190740B96F6F733C801B6428ED4B52B607","C41B4E11E6A9E3B53DA1F92B213DE9F65A825C92","B370B674CE877B9C0A7708C7834AEB7EDA983564","3449A349B6C8045B16DF4F88D58C65C2BDF891BB","B194A997C9A653134BDB1F2D0C3137DCDACB54D5","A195810C41F401C4B48CB557CF8CE60C2D807025","E90D2730F3354FF1ADF334B03C95EAC3207D47B9")

    Detection Query 6 :

    sha256hash IN ("A5D36EDC34FE54B2092349F877DAF560A98F5FEA635D1AC4A110B3518102EF96","7462CE2595119C928CF516EC33148DC2A39DD9F71636A5C849C7ED93B7C5CA06","3BD3B300F3278520819A06D0CB1F0EADBF946DBBC11352538246FF075EB427F1","795594AD5E6F2868CC4D8ED12DABF4F3999A1477C6B250527C5EDE9A98528FB9","2B6CDAFDFE427A3DE1A94A8A2CA1F09FC4C8F90E4F59089FD9B35B73185ED01C","6634339B813E6105B5138DE6AB67B016B8DFBF49233C29DE9BAB3207E8B50D24","DC666E9C148BBCA5E21D8C9A97143575C075F53360F135E0191AED9E8278D396","5CBB64375636E83B5F17D6083633CECC02E2A5F4168CD7CCA5CDEE36CCCA9B38","A53D756F28457B1C4A239C91CDEC8ED7B7DA67A93E332E6DF9621CBEF8417474","D9DB5CBC193DDAF4C0A265804FDEF70C32451DAAF2974FA9ADF52CE1DEFAC5F7","6932A20AC61FD3F93D7CFEE414F6F46834068AC7C9CA011B054A6A10DC56B3D1")

    Reference:    

    https://www.fortinet.com/blog/threat-research/quickfox-supply-chain-attack-used-to-deploy-fdmtp-implant          


    Tags

    MalwareTrojanChinaSupply chain attackLoader

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.