[ { "id": 2688487811, "indicator": "35a04b3434dfe52464f32a831cd350cdb8c5b679", "type": "YARA", "created": "2026-04-06T06:39:54", "content": "rule skip20_sqllang_hook \n { \n meta: \n author = \"Mathieu Tartare \" \n date = \"21-10-2019\" \n description = \"YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.\" \n reference = \"https://www.welivesecurity.com/\" \n source = \"https://github.com/eset/malware-ioc/\" \n contact = \"github@eset.com\" \n license = \"BSD 2-Clause\" \n \n strings: \n $1_0 = {ff f3 55 56 57 41 56 48 81 ec c0 01 00 00 48 c7 44 24 38 fe ff ff ff} \n $1_1 = {48 8b c3 4c 8d 9c 24 a0 00 00 00 49 8b 5b 10 49 8b 6b 18 49 8b 73 20 49 8b 7b 28 49 8b e3 41 5e c3 90 90 90 90 90 90 90 ff 25} \n $2_0 = {ff f3 55 57 41 55 48 83 ec 58 65 48 8b 04 25 30 00 00 00} \n $2_1 = {48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ff 25} \n $3_0 = {89 4c 24 08 4c 8b dc 49 89 53 10 4d 89 43 18 4d 89 4b 20 57 48 81 ec 90 00 00 00} \n $3_1 = {4c 8d 9c 24 20 01 00 00 49 8b 5b 40 49 8b 73 48 49 8b e3 41 5f 41 5e 41 5c 5f 5d c3} \n $4_0 = {ff f5 41 56 41 57 48 81 ec 90 00 00 00 48 8d 6c 24 50 48 c7 45 28 fe ff ff ff 48 89 5d 60 48 89 75 68 48 89 7d 70 4c 89 65 78} \n $4_1 = {8b c1 48 8b 8c 24 30 02 00 00 48 33 cc} \n $5_0 = {48 8b c4 57 41 54 41 55 41 56 41 57 48 81 ec 90 03 00 00 48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20} \n $5_1 = {48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20} \n $6_0 = {44 88 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00} \n $6_1 = {48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00 48 c7 84 24 e8 00 00 00 fe ff ff ff} \n $7_0 = {08 48 89 74 24 10 57 48 83 ec 20 49 63 d8 48 8b f2 48 8b f9 45 85 c0} \n $7_1 = {20 49 63 d8 48 8b f2 48 8b f9 45 85} \n $8_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [11300-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70} \n $9_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40050-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60} \n $10_0 = {41 56 48 83 ec 50 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 60 48 89 6c 24 68 48 89 74 24 70 48 89 7c 24 78 48 8b d9 33 ed 8b f5 89 6c} \n $10_1 = {48 8b 42 18 4c 89 90 f0 00 00 00 44 89 90 f8 00 00 00 c7 80 fc 00 00 00 1b 00 00 00 48 8b c2 c3 90 90 90} \n $11_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40700-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60} \n $12_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [10650-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60} \n $13_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [41850-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70} \n $14_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [42600-] ff f7 48 83 ec 50 48 c7 44 24 20 fe ff ff ff} \n \n condition: \n any of them \n }", "title": "", "description": "YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.", "expiration": null, "is_active": 1 }, { "id": 4073387430, "indicator": "5b05170f0ffdcc3b740d25773d0de08869879b33", "type": "YARA", "created": "2026-04-06T06:39:54", "content": "rule Emotet \n { \n meta: \n author = \"kevoreilly\" \n description = \"Emotet Payload\" \n cape_type = \"Emotet Payload\" \n strings: \n $snippet1 = {FF 15 [4] 83 C4 0C 68 40 00 00 F0 6A 18} \n $snippet3 = {83 3D [4] 00 C7 05 [8] C7 05 [8] 74 0A 51 E8 [4] 83 C4 04 C3 33 C0 C3} \n $snippet4 = {33 C0 C7 05 [8] C7 05 [8] A3 [4] A3 [19] 00 40 A3 [4] 83 3C C5 [4] 00 75 F0 51 E8 [4] 83 C4 04 C3} \n $snippet5 = {8B E5 5D C3 B8 [4] A3 [4] A3 [4] 33 C0 21 05 [4] A3 [4] 39 05 [4] 74 18 40 A3 [4] 83 3C C5 [4] 00 75 F0 51 E8 [4] 59 C3} \n $snippet6 = {33 C0 21 05 [4] A3 [4] 39 05 [4] 74 18 40 A3 [4] 83 3C C5 [4] 00 75 F0 51 E8 [4] 59 C3} \n $snippet7 = {8B 48 ?? C7 [5-6] C7 40 [4] ?? C7 [2] 00 00 00 [0-1] 83 3C CD [4] 00 74 0E 41 89 48 ?? 83 3C CD [4] 00 75 F2} \n $snippet8 = {85 C0 74 3? B9 [2] 40 00 33 D2 89 ?8 [0-1] 89 [1-2] 8B [1-2] 89 [1-2] EB 0? 41 89 [1-2] 39 14 CD [2] 40 00 75 F? 8B CE E8 [4] 85 C0 74 05 33 C0 40 5E C3} \n $snippet9 = {85 C0 74 4? 8B ?8 [0-1] C7 40 [5] C7 [5-6] C7 40 ?? 00 00 00 00 83 3C CD [4] 00 74 0? 41 89 [2-3] 3C CD [4] 00 75 F? 8B CF E8 [4] 85 C0 74 07 B8 01 00 00 00 5F C3} \n $snippetA = {85 C0 74 5? 8B ?8 04 89 78 28 89 38 89 70 2C EB 04 41 89 48 04 39 34 CD [4] 75 F3 FF 75 DC FF 75 F0 8B 55 F8 FF 75 10 8B 4D EC E8 [4] 83 C4 0C 85 C0 74 05} \n $snippetB = {EB 04 4? 89 [2] 39 [6] 75 F3} \n $snippetC = {EB 03 4? 89 1? 39 [6] 75 F4} \n $snippetD = {8D 44 [2] 50 68 [4] FF 74 [2] FF 74 [2] 8B 54 [2] 8B 4C [2] E8} \n $snippetE = {FF 74 [2] 8D 54 [2] FF 74 [2] 68 [4] FF 74 [2] 8B 4C [2] E8 [4] 8B 54 [2] 83 C4 10 89 44 [2] 8B F8 03 44 [2] B9 [4] 89 44 [2] E9 [2] FF FF} \n $snippetF = {FF 74 [2] 8D 44 [2] BA [4] FF 74 [2] 8B 4C [2] 50 E8 [4] 8B 54 [2] 8B D8 8B 84 [5] 83 C4 0C 03 C3 89 5C [2] 8B FB 89 44} \n $snippetG = {FF 74 [2] 8B 54 [2] 8D 44 [2] 8B 4C [2] 50 E8 [4] 8B D0 83 C4 0C 8B 44 [2] 8B FA 03 C2 89 54 [2] 89 44} \n $snippetH = {FF 74 [2] 8D 84 [5] 68 [4] 50 FF 74 [2] 8B 54 [2] 8B 4C [2] E8 [4] 8B 94 [5] 83 C4 10 89 84 [5] 8B F8 03 84} \n $snippetI = {FF 74 [2] 8D 8C [5] FF 74 [2] 8B 54 [2] E8 [4] 8B 54 [2] 8B D8 8B 84 [5] 83 C4 0C 03 C3 89 5C [2] 8B FB 89 44 24 74} \n $snippetJ = {FF 74 [2] 8B 4C [2] 8D 44 [2] 50 BA [4] E8 [4] 8B 54 [2] 8B F8 59 89 44 [2] 03 44 [2] 59 89 44 [2] B9 [4] E9} \n $snippetK = {FF 74 [2] FF 74 [2] 8B 54 [2] E8 [4] 8B 54 [2] 83 C4 0C 89 44 [2] 8B F8 03 44 [2] B9 [4] 89 44 [2] E9} \n $snippetL = {FF 74 [2] 8B 54 [2] 8D 4C [2] E8 [4] 59 89 44 [2] 8B F8 03 44 [2] 59 89 44 24 68 B9 [4] E9} \n $snippetM = {FF 74 [2] 8D 84 [3] 00 00 B9 [4] 50 FF 74 [2] FF 74 [2] 8B 94 [3] 00 00 E8 [4] 83 C4 10 89 44 [2] 8B F8 B9 [4] 03 84 [3] 00 00 89 44 [2] E9} \n $snippetN = {FF 74 [2] 8D 44 [2] B9 [4] FF 74 [2] 50 FF 74 [2] 8B 54 [2] E8 [4] 8B 8C [3] 00 00 83 C4 10 03 C8 89 44 [2] 89 4C [2] 8B F8 B9 45 89 77 05 E9} \n $snippetO = {8D 44 [2] B9 [4] 50 FF 74 [2] 8B 54 [2] E8 [4] 8B D0 8B 44 [2] 59 59 03 C2 89 54 [2] 8B FA 89 44 [2] B9 [4] E9} \n $snippetP = {FF 74 [2] 8B 54 [2] 8D 44 [2] 8B 4C [2] 68 [4] 50 E8 [4] 8B D0 83 C4 0C 8B 44 [2] 8B FA 03 C2 89 54 [2] 8B 54 [2] B9 [4] 89 44 [2] E9} \n $snippetQ = {FF 74 [2] BA [4] 8D 4C [2] FF 74 [2] E8 [4] 59 89 84 [3] 00 00 8B F8 03 44 [2] 59 89 44 [2] B9 [4] 81 F9 [4] 74 28 8B 54 [2] E9} \n $snippetR = {8D 44 [2] 50 FF 74 [2] 8B 54 [2] 8B 4C [2] 68 [4] E8 [4] 8B D0 83 C4 0C 8B 44 [2] 8B FA 03 C2 89 54 [2] 8B 54 [2] B9 [4] 89 44 [2] E9} \n $snippetS = {FF 74 [2] 8D 54 [2] FF 74 [2] 8B 4C [2] E8 [4] 8B D0 83 C4 0C 8B 44 [2] 8B FA 03 C2 89 54 [2] 8B 54 [2] B9 [4] 89 44 [2] E9} \n $snippetT = {8B 54 [2] 8D 44 [2] 8B 4C [2] 68 [4] 50 E8 [4] 8B 9C [3] 00 00 8B F8 59 59 03 D8 89 44 [2] 89 5C [2] B9 [4] EB} \n $snippetU = {89 44 [2] 33 D2 8B 44 [2] F7 F1 B9 [4] 89 44 [2] 8D 44 [2] 81 74 [6] C7 44 [6] 81 44 [6] 81 74 [6] FF 74 [2] 50 FF 74 [2] FF 74 [2] 8B 54 [2] E8} \n $snippetV = {81 74 [2] ED BC 9C 00 FF 74 [2] 50 68 [4] FF 74 [2] 8B 54 [2] 8B 4C [2] E8} \n $snippetW = {4C 8D [2] 8B [2] 4C 8D 05 [4] F7 E1 2B CA D1 E9 03 CA C1 E9 06 89} \n $snippetX = {4C 8D 0? [2] (00|01) 00 [0-80] 48 8D [0-9] 81 75 [5] C7 45 [5-14] 81} \n $snippetY = {(3D [4] 0F 84 [4] 3D [4] 0F 85 [3] ??|B8 [4] E9 [3] ??) 48 8D 05 [4] 48 89 (81 [3] ??|41 ??) 48 8D 05 [4] 48 89 (81 [3] ??|41 ??) 48 8D 05 [4] 48 89} \n $snippetZ = {(48 8B D8 48 85 C0 0F 84 [4-9] E9 [4-190] ?? | 55 53 48 8D AC 24 [2] FF FF 48 81 EC [2] 00 00 48 8B [3] 00 00 [0-80] ??) 48 8D 05 [4] 48 89 (85 [3] ??|4? ??) [0-220] 48 8D 05 [4] 48 89 (85 [3] ??|4? ??) [0-220] 48 8D 05 [4] 48 89 (85 [3] ??|4? ??)} \n $comboA1 = {83 EC 28 56 FF 75 ?? BE} \n $comboA2 = {83 EC 38 56 57 BE} \n $comboA3 = {EB 04 40 89 4? ?? 83 3C C? 00 75 F6} \n condition: \n uint16(0) == 0x5A4D and any of ($snippet*) or 2 of ($comboA*) \n }", "title": "", "description": "Emotet Payload", "expiration": null, "is_active": 1 }, { "id": 3953962201, "indicator": "https://www.welivesecurity.com/", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3953962202, "indicator": "https://github.com/eset/malware-ioc/", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883566423, "indicator": "github@eset.com", "type": "email", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3737280864, "indicator": "mathieu.tartare@eset.com", "type": "email", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 1582995916, "indicator": "www.welivesecurity.com", "type": "hostname", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387431, "indicator": "a0f09634b9ec6b5418d9f6be9e3156ee", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387432, "indicator": "b091a3e0c109535655e1019b1c5dee63", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387433, "indicator": "b381724b956a3517f2dd17f716b00746", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387434, "indicator": "a900f1d2690997bc0508446c70c71ae1e430b70e", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387435, "indicator": "047762558e0fad2ca4d7f2ea925e83f483fa8cfdb7e1c26faf7dae81937d2cb1", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387436, "indicator": "d68dad1c6f86786d0ef1401b46a989246014d61c5efa15b74b68029dc6c79b21", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567085, "indicator": "0900f79b7c099f8ee4b6d68993bfefae815c8ea0605ef52c8689c07afca6cec1", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567086, "indicator": "13a34a672e3d2c6bdef1ed0041ad831e54a7e4492203a0a9a5ba8a63c8c1a5d7", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3783353051, "indicator": "1890663b64624ffde4323964aabcd0ab37848c0be5cd0596372f26875d4aa2fa", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567087, "indicator": "201edec03748cfe4ae74c7ead490fe166a629ae5862cfea05dca997b9bc7f2f6", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567089, "indicator": "39d48072f337731d0745d672ff153887efd661ab0c07e569d8abe8f4f5df5a71", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567090, "indicator": "3af6fc92591776023b0c1e48aa6697b95f5d6c463d9533853b54905ec65b43c5", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772090942, "indicator": "65dcec457c99d635b8a4c4e650def86f6be42e145673295d83e3f7e659086a32", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567094, "indicator": "7b0d3a159bb72fe418d2b5a1c4a8a72b267ad5441d1f63b22b000f8ac7542e54", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567095, "indicator": "8101890a483c0b14fdbf34fa5a46101411746ca97437a844094175b80c455a90", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567096, "indicator": "86f0d0901aceda457d9ba7b67196c6cd5508999c0e74de73f9e0cd142d345b68", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567097, "indicator": "8a1b2abb317626ad6a17ccd8dc4b3eb033202c12542506bd8bf367cc83df0dde", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567098, "indicator": "8aef3b313fb8c6cc94c6d170fd716e7e3e2eb7ab060b404fb8af5356c03adfa3", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772091599, "indicator": "8bc5012112af64230091bb4ce0e36c62c84c752627bac7a6f82be4f06d6ce2bd", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567100, "indicator": "9d559734a2b77f91644c93b12767366de91aa8f642ae4a7dfb9a08f5760b8341", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772091600, "indicator": "a0493f6995be73d43195dedf6e786bb14ac88a363c942d365aef40a04ce4714c", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567102, "indicator": "a67cbfaf8b883f44d1247c5a4855054ade5598d06194baca3917965c6360d824", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567103, "indicator": "aff62e7b494823289ce2eee7d2837a1502a16fee6f961c3ae63a849633883d7f", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567105, "indicator": "c3b9ff566cfdde588fb5b7da16353adcb4b9b058c030e171845d62b1a8ae8b85", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567106, "indicator": "c77e8ecb839129bc8e17ce06cdda9cae35219a7e958261b47951dd71bd9a974d", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567108, "indicator": "ea8ca60803c0daa33e401009ee7f942cab813a58f09f2f34557f89fe9ef51160", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2860537891, "indicator": "getbumptop.com", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387441, "indicator": "00e5d052f9904e19653f2ec695cb2461", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3859494342, "indicator": "0b892f4428689112775a5daab8300267", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746945, "indicator": "1a0563f7fb85a678771450b131ed66fd", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746947, "indicator": "20f0110ed5e4e0d5384a496e4880139b", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3773143743, "indicator": "254f6d7f0b0757490df055cf78702540", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746948, "indicator": "25d76ee5fb5b890f2cc022d94a42fe19", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772675693, "indicator": "276dba142e77c21d5730a29e19308108", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387442, "indicator": "2f04fbf92f04e5d23637486e552f0a74", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3859494345, "indicator": "33bce58bb0493deaf5f1492aa86c7e7f", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2922614369, "indicator": "3c428b1a3e5f57d887ec4b864fac5dcc", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746950, "indicator": "3cb8faccd5de434d415ab75c17e8fd86", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387443, "indicator": "43e2624ff4ca3403c9bada29611e481a", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387444, "indicator": "472612bc4a07dd94f8caf551cd6fba81", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387445, "indicator": "4e245004e7532249d9867075d680f38c", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387446, "indicator": "5080e561c4d04eefc12c4519128e1774", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3859494349, "indicator": "50811b0cb68f8d937ffe15fbb9c0ad60", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3774581660, "indicator": "52ac2155ece4452e24b5b2a307f6d3af", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746951, "indicator": "555e83ce7f5d280d7454af334571fb25", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387447, "indicator": "55a3f5085549323488d95851882e73f2", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3833383964, "indicator": "6082151bd56ea922e1357f5896a90d0a", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746954, "indicator": "68e03ed57ec741a4afbbcd11fab1bdbe", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387448, "indicator": "68ecc7bf207742829a688cf7ea3b25b8", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387449, "indicator": "6e1dc9ee4f553558025775d0142e36a8", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746956, "indicator": "6f20ba58551e13cfd87ec059327effd0", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387450, "indicator": "717b80f1abbd3db46c3672c7f04317cd", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772675697, "indicator": "740b16cf8e8388c014b809780101546a", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387451, "indicator": "7576926b06f3f98440b509311001ccb1", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3773143748, "indicator": "7f335f341768626a767f969c787206a6", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387452, "indicator": "829eb78cf9d83a0ce391b5aeba2ce366", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387453, "indicator": "865402edfb399ade31acec7737ec0477", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3774583439, "indicator": "9b49291ea79f6e900632c6e0b001a89e", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3894619653, "indicator": "a783928ccd8cc48ce1b9f5c80eb0c4cf", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387454, "indicator": "a9af7475e858daaed9b440b133645061", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3859494358, "indicator": "afadff6da55a3f2ae48cb863e28437fa", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387455, "indicator": "b1c48e8e2b71efcf101bf50392e3e1db", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3833384201, "indicator": "b27eb566214c60b6a5feab1a4389fc83", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387456, "indicator": "b2a3034a02d7534a0ceea44ebeaa4090", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3859494359, "indicator": "b7d3c73026c6c451dd7e4b474f73f832", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387457, "indicator": "b9bb15ef6bb313e08dcb10d645b07b81", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 203581574, "indicator": "d7a950fefd60dbaa01df2d85fefb3862", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387458, "indicator": "e50ea7bd9d3e85c226131f0c7f869e46", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746959, "indicator": "e7ca76a3c9ee0564471671d500e3f0f3", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3859494365, "indicator": "eb80e47ad01200838930a7ab306e036d", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 983746960, "indicator": "f4fe1cb77e758e1ba56b8a8ec20417c5", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387459, "indicator": "f5e918805f952338e0c1c7adb56bd008", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3859494368, "indicator": "fabc417470d58f30fe31d480c212851d", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3773143754, "indicator": "48ed68b0b070f3a9ba5b9a2878a7ad3b40809a60", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA1 of 254f6d7f0b0757490df055cf78702540", "expiration": null, "is_active": 1 }, { "id": 3833383968, "indicator": "f21bf2f13f89d1c9dfd2844d57728102d5714eaa", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA1 of 6082151bd56ea922e1357f5896a90d0a", "expiration": null, "is_active": 1 }, { "id": 3833383969, "indicator": "6e3892b200f7e99814d4f8a7d1aab62cdd8f50c65d53f2c7f85bb41a73c991a0", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA256 of 6082151bd56ea922e1357f5896a90d0a", "expiration": null, "is_active": 1 }, { "id": 3773143755, "indicator": "a8fa0b3e2d2aafba84c49a22b7f417818f6569eb33890b3926dec75b0850529a", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA256 of 254f6d7f0b0757490df055cf78702540", "expiration": null, "is_active": 1 }, { "id": 2270840125, "indicator": "451c23709ecd5a8461ad060f6346930c", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "Osx.Malware.Agent-8019494-0", "description": "MD5 of 58b0516d28bd7218b1908fb266b8fe7582e22a5f", "expiration": null, "is_active": 1 }, { "id": 3653963275, "indicator": "6426fe4dc604c7f1784ed1d48ab4ffc8", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "MD5 of 3b88cda62cdd918b62ef5aa8c5a73a46f176d18b", "expiration": null, "is_active": 1 }, { "id": 660, "indicator": "760c35a80d758f032d02cf4db12d3e55", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "Win.Trojan.Wiper-1", "description": "MD5 of 1c66e67a8531e3ff1c64ae57e6edfde7bef2352d", "expiration": null, "is_active": 1 }, { "id": 3595666433, "indicator": "76111d9780b2d0b5adee61cf752d937e", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "MD5 of 5b03294b72c0caa5fb20e7817002c600645eb475", "expiration": null, "is_active": 1 }, { "id": 238306921, "indicator": "9e4d9edb07c348b10863d89b6bb08141", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "Trojan:Win32/Autophyte.H!dha", "description": "MD5 of 65122e5129fc74d6b5ebafcc3376abae0145bc14", "expiration": null, "is_active": 1 }, { "id": 3667737953, "indicator": "aac5a52b939f3fe792726a13ff7a1747", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "stack_string", "description": "MD5 of f6760fb1f8b019af2304ea6410001b63a1809f1d", "expiration": null, "is_active": 1 }, { "id": 3600135914, "indicator": "af2bc70f1c97a2f583f7b87aea3c8a6c", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "MD5 of 7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec", "expiration": null, "is_active": 1 }, { "id": 367171231, "indicator": "c01dc42f65acaf1c917c0cc29ba63adc", "type": "FileHash-MD5", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "MD5 of d288766fa268bc2534f85fd06a5d52264e646c47", "expiration": null, "is_active": 1 }, { "id": 3667737956, "indicator": "0ca1723afe261cd85b05c9ef424fc50290dce7df", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 235595, "indicator": "1c66e67a8531e3ff1c64ae57e6edfde7bef2352d", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "Win.Trojan.Wiper-1", "description": "", "expiration": null, "is_active": 1 }, { "id": 3667737957, "indicator": "2acc6f1d4656978f4d503929b8c804530d7e7cf6", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3653963274, "indicator": "3b88cda62cdd918b62ef5aa8c5a73a46f176d18b", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2863672709, "indicator": "58b0516d28bd7218b1908fb266b8fe7582e22a5f", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "Osx.Malware.Agent-8019494-0", "description": "", "expiration": null, "is_active": 1 }, { "id": 3595666438, "indicator": "5b03294b72c0caa5fb20e7817002c600645eb475", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 238306922, "indicator": "65122e5129fc74d6b5ebafcc3376abae0145bc14", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "Trojan:Win32/Autophyte.H!dha", "description": "", "expiration": null, "is_active": 1 }, { "id": 3600135915, "indicator": "7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3653999909, "indicator": "cad1120d91b812acafef7175f949dd1b09c6c21a", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 367171234, "indicator": "d288766fa268bc2534f85fd06a5d52264e646c47", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3667737960, "indicator": "dcef83d8ee080b54dc54759c59f955e73d67aa65", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3667737961, "indicator": "f6760fb1f8b019af2304ea6410001b63a1809f1d", "type": "FileHash-SHA1", "created": "2026-04-06T06:39:54", "content": "", "title": "stack_string", "description": "", "expiration": null, "is_active": 1 }, { "id": 367171229, "indicator": "4257bb11570ed15b8a15aa3fc051a580eab5d09c2f9d79e4b264b752c8e584fc", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA256 of d288766fa268bc2534f85fd06a5d52264e646c47", "expiration": null, "is_active": 1 }, { "id": 239044039, "indicator": "5a07b09eea34d7faa9c37e2806a556cd95f97699597bd1123339849b6e942d95", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "Trojan:Win32/Autophyte.H!dha", "description": "SHA256 of 65122e5129fc74d6b5ebafcc3376abae0145bc14", "expiration": null, "is_active": 1 }, { "id": 2863335428, "indicator": "5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "Osx.Malware.Agent-8019494-0", "description": "SHA256 of 58b0516d28bd7218b1908fb266b8fe7582e22a5f", "expiration": null, "is_active": 1 }, { "id": 3595666452, "indicator": "9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA256 of 5b03294b72c0caa5fb20e7817002c600645eb475", "expiration": null, "is_active": 1 }, { "id": 3653963276, "indicator": "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA256 of 3b88cda62cdd918b62ef5aa8c5a73a46f176d18b", "expiration": null, "is_active": 1 }, { "id": 3667737963, "indicator": "cc307cfb401d1ae616445e78b610ab72e1c7fb49b298ea003dd26ea80372089a", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "stack_string", "description": "SHA256 of f6760fb1f8b019af2304ea6410001b63a1809f1d", "expiration": null, "is_active": 1 }, { "id": 1484, "indicator": "e2ecec43da974db02f624ecadc94baf1d21fd1a5c4990c15863bb9929f781a0a", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "Win.Trojan.Wiper-1", "description": "SHA256 of 1c66e67a8531e3ff1c64ae57e6edfde7bef2352d", "expiration": null, "is_active": 1 }, { "id": 3598439953, "indicator": "ea31e626368b923419e8966747ca33473e583376095c48e815916ff90382dda5", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "SHA256 of 7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec", "expiration": null, "is_active": 1 }, { "id": 3667737968, "indicator": "https://journalide.org/djour.php", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3667737970, "indicator": "73ebb8715a33dce62f3ea8472ccbbdf4106f4be1", "type": "YARA", "created": "2026-04-06T06:39:54", "content": "import \"pe\"\nrule RichHeaders_Lazarus_NukeSped_IconicPayloads_3CX_Q12023 \n { \n \tmeta: \n \t\tdescription = \" Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12\" \n \t\tauthor = \"ESET Research\" \n \t\tdate = \"2023-03-31\" \n \t\thash = \"3B88CDA62CDD918B62EF5AA8C5A73A46F176D18B\" \n \t\thash = \"CAD1120D91B812ACAFEF7175F949DD1B09C6C21A\" \n \t\thash = \"5B03294B72C0CAA5FB20E7817002C600645EB475\" \n \t\thash = \"7491BD61ED15298CE5EE5FFD01C8C82A2CDB40EC\" \n \tcondition: \n \t\tpe.rich_signature.toolid(259, 30818) == 9 and \n \t\tpe.rich_signature.toolid(256, 31329) == 1 and \n \t\tpe.rich_signature.toolid(261, 30818) >= 30 and pe.rich_signature.toolid(261, 30818) <= 38 and \n \t\tpe.rich_signature.toolid(261, 29395) >= 134 and pe.rich_signature.toolid(261, 29395) <= 164 and \n \t\tpe.rich_signature.toolid(257, 29395) >= 6 and pe.rich_signature.toolid(257, 29395) <= 14 \n }", "title": "", "description": "Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12", "expiration": null, "is_active": 1 }, { "id": 3661318014, "indicator": "apdl.cf", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3653854826, "indicator": "journalide.org", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3024233477, "indicator": "pe.rich", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 1657593870, "indicator": "od.lk", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387460, "indicator": "offer.pdf.zip", "type": "hostname", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2234198473, "indicator": "threatintel@eset.com", "type": "email", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387461, "indicator": "fncbukvmnw.com", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387462, "indicator": "glassdoornews.com", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387463, "indicator": "lionshearts.buzz", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387464, "indicator": "malisuguba.com", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387465, "indicator": "mezlan.me", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387466, "indicator": "plankproductions.com", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387467, "indicator": "raniersec.com", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3356985493, "indicator": "zevegan.com", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387468, "indicator": "http://23.254.211.230:25", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387469, "indicator": "http://23.254.211.230:443", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387470, "indicator": "http://23.254.211.230:587", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387471, "indicator": "http://23.254.211.230:80", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387472, "indicator": "http://glassdoornews.com", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387473, "indicator": "http://mezlan.me/", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387474, "indicator": "http://plankproductions.com/", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387475, "indicator": "http://zevegan.com/", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387476, "indicator": "https://23.254.211.230:443", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387477, "indicator": "https://glassdoornews.com", "type": "URL", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3277973333, "indicator": "naveeocorp.xyz", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3310058022, "indicator": "nxmnv.site", "type": "domain", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387478, "indicator": "216734e1ab6e337b500bde6871afcd08b6fbde755fcce69dd18689def204f86c", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2239495122, "indicator": "34b4546e3468238702df24794e598add494beaeacf95df10af54d88b3d241e8a", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387479, "indicator": "379e04008c61b63081aaa804823529ce7af1851e7532497b3f9274528b0f778a", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387480, "indicator": "7b6ed450bba75fd243f84561acfa021421597ac735a1e3aadef00820b75aeaf4", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387481, "indicator": "a858b53bf93d04e9a020044979a1a4a7fe03800c317656b536ee5b072e2b96ca", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2783220101, "indicator": "c82d2405c24460a321660fad72e99c8774b21c27b1144f2866fb92eae24ff62d", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387482, "indicator": "cd9a2af1a299cca858481c92bf9279edc54ddef1de0acf3baf4157790167ed92", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387483, "indicator": "d0fca086459060de186520077bea5f3787896d4e74dd62d74c9a8cfc2f4a4317", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3003081297, "indicator": "d18b6a18edb2e780ed1f8140985e1c5c1abc4b88c4f5f497905305ea2a0bdc33", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2129547804, "indicator": "e00716e37a7198ae71a35cbfcdeb48fbe3e27b975aafae657bc951d135ce5431", "type": "FileHash-SHA256", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4073387484, "indicator": "www.misdatos.intes.com.mx", "type": "hostname", "created": "2026-04-06T06:39:54", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2688487811, "indicator": "35a04b3434dfe52464f32a831cd350cdb8c5b679", "type": "YARA", "created": "2026-04-06T06:41:51", "content": "rule skip20_sqllang_hook \n { \n meta: \n author = \"Mathieu Tartare \" \n date = \"21-10-2019\" \n description = \"YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.\" \n reference = \"https://www.welivesecurity.com/\" \n source = \"https://github.com/eset/malware-ioc/\" \n contact = \"github@eset.com\" \n license = \"BSD 2-Clause\" \n \n strings: \n $1_0 = {ff f3 55 56 57 41 56 48 81 ec c0 01 00 00 48 c7 44 24 38 fe ff ff ff} \n $1_1 = {48 8b c3 4c 8d 9c 24 a0 00 00 00 49 8b 5b 10 49 8b 6b 18 49 8b 73 20 49 8b 7b 28 49 8b e3 41 5e c3 90 90 90 90 90 90 90 ff 25} \n $2_0 = {ff f3 55 57 41 55 48 83 ec 58 65 48 8b 04 25 30 00 00 00} \n $2_1 = {48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ff 25} \n $3_0 = {89 4c 24 08 4c 8b dc 49 89 53 10 4d 89 43 18 4d 89 4b 20 57 48 81 ec 90 00 00 00} \n $3_1 = {4c 8d 9c 24 20 01 00 00 49 8b 5b 40 49 8b 73 48 49 8b e3 41 5f 41 5e 41 5c 5f 5d c3} \n $4_0 = {ff f5 41 56 41 57 48 81 ec 90 00 00 00 48 8d 6c 24 50 48 c7 45 28 fe ff ff ff 48 89 5d 60 48 89 75 68 48 89 7d 70 4c 89 65 78} \n $4_1 = {8b c1 48 8b 8c 24 30 02 00 00 48 33 cc} \n $5_0 = {48 8b c4 57 41 54 41 55 41 56 41 57 48 81 ec 90 03 00 00 48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20} \n $5_1 = {48 c7 80 68 fd ff ff fe ff ff ff 48 89 58 18 48 89 70 20} \n $6_0 = {44 88 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00} \n $6_1 = {48 89 4c 24 08 53 56 57 41 54 41 55 41 56 41 57 48 81 ec 80 01 00 00 48 c7 84 24 e8 00 00 00 fe ff ff ff} \n $7_0 = {08 48 89 74 24 10 57 48 83 ec 20 49 63 d8 48 8b f2 48 8b f9 45 85 c0} \n $7_1 = {20 49 63 d8 48 8b f2 48 8b f9 45 85} \n $8_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [11300-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70} \n $9_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40050-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60} \n $10_0 = {41 56 48 83 ec 50 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 60 48 89 6c 24 68 48 89 74 24 70 48 89 7c 24 78 48 8b d9 33 ed 8b f5 89 6c} \n $10_1 = {48 8b 42 18 4c 89 90 f0 00 00 00 44 89 90 f8 00 00 00 c7 80 fc 00 00 00 1b 00 00 00 48 8b c2 c3 90 90 90} \n $11_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [40700-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60} \n $12_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [10650-] 48 8b c4 55 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 60} \n $13_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [41850-] ff f5 56 57 41 54 41 55 41 56 41 57 48 8b ec 48 83 ec 70} \n $14_0 = {48 89 01 48 8b c2 48 c7 41 08 04 00 00 00 c3 90 90 90 90 90 90 90 90 90 90 89 91 40 [42600-] ff f7 48 83 ec 50 48 c7 44 24 20 fe ff ff ff} \n \n condition: \n any of them \n }", "title": "skip20_sqllang_hook", "description": "", "expiration": null, "is_active": 1 }, { "id": 3602881572, "indicator": "https://labs.inquest.net/dfi/hash/f9b62b2aee5937e4d7f33f04f52ad5b05c4a1ccde6553e18909d2dc0cb595209", "type": "URL", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3602881570, "indicator": "17b405710a0a1137e36601173e06ebdc", "type": "FileHash-MD5", "created": "2026-04-06T06:43:37", "content": "", "title": "Valyria", "description": "MD5 of 510c5b598d83576f9b1da950b245a83927af7559", "expiration": null, "is_active": 1 }, { "id": 3602881571, "indicator": "510c5b598d83576f9b1da950b245a83927af7559", "type": "FileHash-SHA1", "created": "2026-04-06T06:43:37", "content": "", "title": "Valyria", "description": "", "expiration": null, "is_active": 1 }, { "id": 3374693482, "indicator": "f9b62b2aee5937e4d7f33f04f52ad5b05c4a1ccde6553e18909d2dc0cb595209", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "Valyria", "description": "SHA256 of 510c5b598d83576f9b1da950b245a83927af7559", "expiration": null, "is_active": 1 }, { "id": 4125206842, "indicator": "CVE-2024-40898", "type": "CVE", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3589042513, "indicator": "24bfe35b8c9c88c0a05d4c64d8d3ebae", "type": "FileHash-MD5", "created": "2026-04-06T06:43:37", "content": "", "title": "Win32:Evo-gen\\ [Susp]", "description": "MD5 of ba3a789a8497be3970e4521c81cc4e8e9e02b44e", "expiration": null, "is_active": 1 }, { "id": 4050167274, "indicator": "65ae65b110ace37606f55ab79a040bb3", "type": "FileHash-MD5", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4050167275, "indicator": "7e470b98fc2378f4ed0e144bc765fae5", "type": "FileHash-MD5", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2238072920, "indicator": "960a5c48e25cf2bca332e74e11d825c9", "type": "FileHash-MD5", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "MD5 of da35c6816ace5daf4c6c1d57b93b09a82ecdc876", "expiration": null, "is_active": 1 }, { "id": 4004930328, "indicator": "a5a4cee2eb89d2687c05ef74299f0dba", "type": "FileHash-MD5", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 1816963359, "indicator": "bf95d1fc1d10de18b32654b123ad5e1f", "type": "FileHash-MD5", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4004930348, "indicator": "b9bff5987be422887f2f402357b47db2288a1a42", "type": "FileHash-SHA1", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3589042514, "indicator": "ba3a789a8497be3970e4521c81cc4e8e9e02b44e", "type": "FileHash-SHA1", "created": "2026-04-06T06:43:37", "content": "", "title": "Win32:Evo-gen\\ [Susp]", "description": "", "expiration": null, "is_active": 1 }, { "id": 3566774049, "indicator": "da35c6816ace5daf4c6c1d57b93b09a82ecdc876", "type": "FileHash-SHA1", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4050167276, "indicator": "e4ee94211dbcbc65117b8010409db9b4aa93f67f", "type": "FileHash-SHA1", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4050167277, "indicator": "343f3f18c5f99b3b36774aa6cb01bd6700f5baa89a11a924b6a4899be8107d75", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3566774200, "indicator": "484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "SHA256 of da35c6816ace5daf4c6c1d57b93b09a82ecdc876", "expiration": null, "is_active": 1 }, { "id": 4050167278, "indicator": "553d33ea2d5f87552706721957ea643044ab181dff1a2e096787974a3b55911f", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 4004930719, "indicator": "cb82268b778703db75961cddef33a695a674f0dfd28b7e710b198ef2d26d3963", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3589042515, "indicator": "d0c1e946f02503a290d24637b5c522145f58372a9ded9e647d24cd904552d235", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "Win32:Evo-gen\\ [Susp]", "description": "SHA256 of ba3a789a8497be3970e4521c81cc4e8e9e02b44e", "expiration": null, "is_active": 1 }, { "id": 4050167279, "indicator": "0c:c4:18:cf:96:e7:6e:ce:d6:97:3f:78:7a:67:1c:f9:84:ce:b2:66", "type": "SSLCertFingerprint", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3602881569, "indicator": "http://en.wikipedia.org/wiki/Windows_API", "type": "URL", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3953962202, "indicator": "https://github.com/eset/malware-ioc/", "type": "URL", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3953962201, "indicator": "https://www.welivesecurity.com/", "type": "URL", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 1083071900, "indicator": "en.wikipedia.org", "type": "hostname", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 1582995916, "indicator": "www.welivesecurity.com", "type": "hostname", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567085, "indicator": "0900f79b7c099f8ee4b6d68993bfefae815c8ea0605ef52c8689c07afca6cec1", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567086, "indicator": "13a34a672e3d2c6bdef1ed0041ad831e54a7e4492203a0a9a5ba8a63c8c1a5d7", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3783353051, "indicator": "1890663b64624ffde4323964aabcd0ab37848c0be5cd0596372f26875d4aa2fa", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567087, "indicator": "201edec03748cfe4ae74c7ead490fe166a629ae5862cfea05dca997b9bc7f2f6", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567089, "indicator": "39d48072f337731d0745d672ff153887efd661ab0c07e569d8abe8f4f5df5a71", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567090, "indicator": "3af6fc92591776023b0c1e48aa6697b95f5d6c463d9533853b54905ec65b43c5", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772090942, "indicator": "65dcec457c99d635b8a4c4e650def86f6be42e145673295d83e3f7e659086a32", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567094, "indicator": "7b0d3a159bb72fe418d2b5a1c4a8a72b267ad5441d1f63b22b000f8ac7542e54", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567095, "indicator": "8101890a483c0b14fdbf34fa5a46101411746ca97437a844094175b80c455a90", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567096, "indicator": "86f0d0901aceda457d9ba7b67196c6cd5508999c0e74de73f9e0cd142d345b68", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567097, "indicator": "8a1b2abb317626ad6a17ccd8dc4b3eb033202c12542506bd8bf367cc83df0dde", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567098, "indicator": "8aef3b313fb8c6cc94c6d170fd716e7e3e2eb7ab060b404fb8af5356c03adfa3", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772091599, "indicator": "8bc5012112af64230091bb4ce0e36c62c84c752627bac7a6f82be4f06d6ce2bd", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567100, "indicator": "9d559734a2b77f91644c93b12767366de91aa8f642ae4a7dfb9a08f5760b8341", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3772091600, "indicator": "a0493f6995be73d43195dedf6e786bb14ac88a363c942d365aef40a04ce4714c", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567102, "indicator": "a67cbfaf8b883f44d1247c5a4855054ade5598d06194baca3917965c6360d824", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567103, "indicator": "aff62e7b494823289ce2eee7d2837a1502a16fee6f961c3ae63a849633883d7f", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567105, "indicator": "c3b9ff566cfdde588fb5b7da16353adcb4b9b058c030e171845d62b1a8ae8b85", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567106, "indicator": "c77e8ecb839129bc8e17ce06cdda9cae35219a7e958261b47951dd71bd9a974d", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3883567108, "indicator": "ea8ca60803c0daa33e401009ee7f942cab813a58f09f2f34557f89fe9ef51160", "type": "FileHash-SHA256", "created": "2026-04-06T06:43:37", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 } ]