Reused Signed install.exe Loader Renamed Across Fake-Software Campaigns

Duo Tech@duotech

•updated Jul 2, 2026•0•0•0

This rule identifies the execution or presence of a specific malicious installer executable (MD5 87603EA025623B19954E460ADD532048) that is known to be reused and renamed across multiple campaigns to masquerade as legitimate software installers.