← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
IOC - Fake Telegram Malware Campaign: Analysis of a Multi-Stage Loader Delivered via Typosquatted Websites
While surfing the web, we discovered a typosquatted website impersonating the official Telegram download portal that was actively distributing malware. The domain telegrgam[.]com hosts a malicious installer named tsetup-x64.6.exe, which appears to be a legitimate Telegram setup file.
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (7)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| FileHash-MD5 | 62f8effc7690455abcb300e3574f0a93 | — | 2026-03-20 | |
| FileHash-MD5 | a9a5cc6b6766fec51b281b94f5f17ccd | — | 2026-03-20 | |
| URL | http://27.50.59.77:18852 | — | 2026-03-20 | |
| domain | jiijua.com | — | 2026-03-20 | |
| hostname | www.tejlegram.com | — | 2026-03-20 | |
| hostname | www.telefgram.com | — | 2026-03-20 | |
| hostname | www.telegrgam.com | — | 2026-03-20 |