Disco

Disco is a custom implant that has been used by MoustachedBouncer since at least 2020 including in campaigns using targeted malicious content injection for initial access and command and control.

3New IOCs · 24h

42New IOCs · 7 days

42Indicators tracked

1Independent feeds

2026-10-12 02:02Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

Hash42
Malware42

MITRE ATT&CK lists this as malware Disco. Explore the ATT&CK matrix →

Where its infrastructure is hosted

No location data.

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-12 02:02	SHA256	9d3b37a7f1d8ed7fa9a63a11b52cd8483159cee959ef39816c6b24096e43eafb	Malware sample	—
2026-10-11 11:47	SHA256	a40cf0d1a2ac263f21bc8eebbec0e8e5823c4c2859833c395f0cd0b22345d3dd	Malware sample	—
2026-10-11 09:18	SHA256	b156f7f0eeca157ceb217142c3fe83902212f8262dbd748df5114e5d8a3c5458	Malware sample	—
2026-10-11 06:20	SHA256	daa76106443de94b5882cd84f4e71b47312daf55ca81109d3f7056cc9c446a92	Malware sample	—
2026-10-10 14:26	SHA256	2c4875cd727cc5f6d740d394386db28f39aa4ab1ad9bbc41e0fb0ef8b52e2096	Malware sample	—
2026-10-10 09:38	SHA256	0ef7612fd48f4b196fe9e0fb9008764381f4107914431910c8a85e97996940f1	Malware sample	—
2026-10-09 15:37	SHA256	f8ada97c1f87c7fc3079f8e587f43424fe6cf17a39eb4370759dfc1d140092b7	Malware sample	—
2026-10-09 08:04	SHA256	2f2d8e0e6da8f09ab868fc140bdff1e2ac96499258a6eeadba0363e932a506b4	Malware sample	—
2026-10-09 03:17	SHA256	493ce4fdfceacc0ffdae460dafcc352a3792de437b6a7587c7731a5c900409b8	Malware sample	—
2026-10-09 02:31	SHA256	06a7f47ddcc033fbb23c3ad57f7c301ea54848e631d3bfabbc33ef89cac09d6b	Malware sample	—
2026-10-08 15:04	SHA256	3dc0bf04311eb81fbc3bf61d2bbdd54434a00b011e3834cdabd6584bba511054	Malware sample	—
2026-10-08 14:00	SHA256	b1a7e99091a2533c5b4406e965c76d037e19ced89ed5bc2f22ab4aaf55c97642	Malware sample	—
2026-10-08 14:00	SHA256	bbc030f2042903278b4f1b3683e1527b500841a351f23bc29148a1646ccdb654	Malware sample	—
2026-10-08 13:42	SHA256	193e7ece0c3e2d920d2c6e3c534e7374bbb19ea6b16b7f02605cda21d981cba0	Malware sample	—
2026-10-08 13:42	SHA256	1bea85076612327c59915c8ef33b0c5c7d36deb656ef9e3ba7cf10e242b6b1da	Malware sample	—
2026-10-08 13:42	SHA256	dc3fe404c4223f7779ae52e8065e02a5067d5225096132e3da0fcdffbd8e1b46	Malware sample	—
2026-10-08 13:20	SHA256	151124c71db352c9f76d4c8b42799f98b51c4baee78d93d5d89d3bc45a1a04f8	Malware sample	—
2026-10-08 12:54	SHA256	3d64fa84920e210dc6b84a15a7f7d2f545862059aa0723ccf26bf8ea6e1be43a	Malware sample	—
2026-10-08 12:27	SHA256	3862aaf9946ce61a040deee7cd95d627b12035b69dd58d9f4e601c93a878d427	Malware sample	—
2026-10-08 12:27	SHA256	4c30b9ca4e79f7034b7d317bc09f722410ab218b93e169543d40df13949d4298	Malware sample	—
2026-10-08 12:27	SHA256	81381ba92bd5090779e0d9a5ae4cc5e5ec5d1e00adef637e78e5bad70bfb034a	Malware sample	—
2026-10-08 12:27	SHA256	ac669f50cfa65dc2487ba4c41b9eb9bfda34e7bccc0b3b176ae2780788726c0c	Malware sample	—
2026-10-08 12:27	SHA256	b4d948c644f43556ac9a648bd3ff6d3a863fedd1333cb60e5305d87b0cc88283	Malware sample	—
2026-10-08 12:27	SHA256	d3d8ca5feccf5c3d558626358643b2f29d48f00736b4f1bd5c98a8b5494f12d5	Malware sample	—
2026-10-08 12:27	SHA256	db23a09ea9a95257c340f9208b85737a79d4206d486da1fcfe9dd713d7d830ac	Malware sample	—
2026-10-08 12:01	SHA256	0b8f8dd7a368ccc06d4dea2c71fbfca883c5cbf203dacaa8ca583a8524f50ebb	Malware sample	—
2026-10-08 12:01	SHA256	1c28906ad631202054dd959d5f1ae342ec198624e24f665ab5b5cec8017b95db	Malware sample	—
2026-10-08 12:01	SHA256	6493457ee3e9da16b40cc8339b5bd32dbf18bc1c121ebd539f188186a3b15883	Malware sample	—
2026-10-08 12:01	SHA256	826b0371a9c5b4bfc8ec51b72d45377502e91cdcc7416536743d03849f2aa2ad	Malware sample	—
2026-10-08 12:01	SHA256	8d5bb40850cace636177122ef0c081c3194e5b7f76e4fe2da8722e51ba19bd47	Malware sample	—
2026-10-08 11:37	SHA256	3dad3a026c6f9f3470fda07d26c60ccd445cab1b996d80caf1578818fb89a8d6	Malware sample	—
2026-10-08 11:37	SHA256	d830714b75328d39a705289e1a5cbf5c8003e96ac2ffe78f208418aaf219c105	Malware sample	—
2026-10-08 11:37	SHA256	fe20d9b532f258fe3e97b8c16fac0d981a55561f0269a4a686193f00c8bb3fb2	Malware sample	—
2026-10-08 11:12	SHA256	24fc4bc5579b572db7fcfde11a0274f0f8a76d445a2d712552f2eee156581bc6	Malware sample	—
2026-10-08 06:58	SHA256	12c7c51bb29db1f1ad2174f33473df67e7c5cb680126ffef07795eba39f70de9	Malware sample	—
2026-10-08 03:16	SHA256	02383bf1aec901237cbf4fb8d0560ec2a92c075553c0caa35c6a2f381ea5f1e0	Malware sample	—
2026-10-08 01:45	SHA256	f9531502774eb50aebbe03c564ed50a510045dce1469598567d8869e8506dfc8	Malware sample	—
2026-10-07 15:43	SHA256	af8ee787b544a36cc43b8ec4e4f0884a1039b1aef4eec9141e582a8ea9313cc8	Malware sample	—
2026-10-07 13:57	SHA256	a04cfe562096872ac940dd99a03e160549e28a540eaddad8e361668fe0997d1c	Malware sample	—
2026-10-07 11:48	SHA256	5602e3313d072fa90b92b449dd61a06ac6064a186dbdb0064ed566fe680bd8f0	Malware sample	—
2026-10-07 11:09	SHA256	85b8d34b79505dee39cb5c142942acb53af2566223fbc7a5238d9bb45d54e001	Malware sample	—
2026-10-07 10:48	SHA256	ea347ee18b4a46898c8075712dd2c3ac99da9f1f93f62f9503a0ade8e8417aeb	Malware sample	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check