medium
advisory
Rugmi malware identified in the wild
A new sample of the Rugmi malware family (sha256: 2ffcecf20d5601ccbed1d74da694d41673d06b759681e3d9585faa241f5bb7f9) has been observed as a Windows-based payload.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 13:39 UTC
- Detection
- 1 IOC
- Source quality
- A2Likely
On 2026-11-04, an additional indicator of compromise associated with the Rugmi malware family was identified. The observed artifact is a Windows executable payload.
Recommendation
- Block the SHA-256 hash identified in the IOC table on all security endpoints.
- Implement file integrity monitoring and endpoint scanning to identify presence of the Rugmi payload.
Immediate actions
Block the identified SHA-256 hash on endpoint and mail gateways
SOC
24h
Threat Hunt
Search for execution of the identified SHA-256 file hash on Windows endpoints
high
high confidence
hunt now
Data: Endpoint telemetry (FileCreate, ProcessCreation)
Indicators of compromise
1
hash_sha256
| Type | Value |
|---|---|
| hash_sha256 | 2ffcecf20d5601ccbed1d74da694d41673d06b759681e3d9585faa241f5bb7f9 |