ESET malware-ioc

Dépôt

https://github.com/eset/malware-ioc

Commit

17baf44964a77368e9149f4f593eb098beddf1c5

Récupéré le

2026-09-27

Licence

BSD 2-Clause License

©

Copyright (c) 2014-2018 ESET spol. s r.o.

Publication

Texte complet

Justification

BSD 2-Clause: redistribution allowed with the copyright notice and licence text retained.

Télécharger le pack (.yar, 57 règles)

Copyright (c) 2014-2018 ESET spol. s r.o.
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Règles de ESET malware-ioc

• ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023

  Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12

  MalwareESET malware-ioc· ESET Research· 2023-03-31
• ESET_Cw_Windows_Redline_Panel_Distinctive_Strings

  Matches rare strings found in Redline panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• ESET_Cw_Windows_Redline_Panel_Prompts

  Matches prompt messages in Redline panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• ESET_Cw_Windows_Redline_Panel_Status_Message_Strings

  Matches error/success messages in Redline panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• ESET_Cw_Windows_Redline_Panel_Tab_Headers

  Matches view headers in Redline Panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• ESET_Apt_Windows_Invisimole

  InvisiMole magic values, keys and strings

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_CPL_Loader

  CPL loader

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_DNS_Downloader

  InvisiMole DNS downloader

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_Logs

  Detects log files with collected created by InvisiMole's RC2CL backdoor

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_SFX_Dropper

  Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_TA410_Lookback_Decryption

  Matches encryption/decryption function used by LookBack.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_HTTP

  Matches LookBack's hardcoded HTTP request

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_Loader

  Matches the modified function in LookBack libcurl loader.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_Magic

  Matches message header creation in LookBack.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_Strings

  Matches multiple strings and export names in TA410 LookBack.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_IIS_Group04_Rgdoor

  Detects Group 4 native IIS malware family (RGDoor)

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group07_Iispy

  Detects Group 7 native IIS malware family (IISpy)

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_Invisimole_Blob_PRIVATE

  Detects InvisiMole blobs by magic values

  MalwareESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_TA410_Tendyron_Dropper

  TA410 Tendyron Dropper

  APT / acteurESET malware-ioc· ESET Research· 2020-12-09
• ESET_Apt_Windows_Invisimole_RC2CL_Backdoor

  InvisiMole RC2CL backdoor

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption

  Matches the function used to decrypt resources headers in TA410 FlowCloud

  APT / acteurESET malware-ioc· ESET Research· 2026-01-27
• ESET_Ebury_V1_7_Crypto

  This rule detects the strings decryption routine in Ebury v1.7 and v1.8

  GénériqueESET malware-ioc· ESET, spol. s r.o.· 2023-08-01
• ESET_Mozi_Killswitch

  Mozi botnet kill switch

  MalwareESET malware-ioc· Ivan Besina· 2023-09-29
• ESET_Apt_Windows_TA410_Flowcloud_Dll_Hijacking_Strings

  Matches filenames inside TA410 FlowCloud malicious DLL.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Flowcloud_Fcclient_Strings

  Strings found in fcClient/rescure.dat module.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings

  Strings found in fcClientDll/responsor.dat module.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Flowcloud_Malicious_Dll_Antianalysis

  Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Flowcloud_Pdb

  Matches PDB paths found in TA410 FlowCloud.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Flowcloud_Shellcode_Decryption

  Matches the decryption function used in TA410 FlowCloud self-decrypting DLL

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Rootkit_Strings

  Strings found in TA410's Rootkit

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_IIS_Group03

  Detects Group 3 native IIS malware family

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group05_Iistealer

  Detects Group 5 native IIS malware family (IIStealer)

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group06_ISN

  Detects Group 6 native IIS malware family (ISN)

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group10

  Detects Group 10 native IIS malware family

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group11

  Detects Group 11 native IIS malware family

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group13_Iiserpent

  Detects Group 13 native IIS malware family (IISerpent)

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group14

  Detects Group 14 native IIS malware family

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_Sparklinggoblin_Chacha20

  SparklingGoblin ChaCha20 implementations

  GénériqueESET malware-ioc· ESET Research· 2021-05-20
• ESET_Sparklinggoblin_Chacha20Loader_Richheader

  Rule matching ChaCha20 loaders rich header

  GénériqueESET malware-ioc· ESET Research· 2021-03-30
• ESET_Sparklinggoblin_Etweventwrite

  SparklingGoblin EtwEventWrite patching

  GénériqueESET malware-ioc· ESET Research· 2021-05-20
• ESET_Sparklinggoblin_Mutex

  SparklingGoblin ChaCha20 loaders mutexes

  GénériqueESET malware-ioc· ESET Research· 2021-05-20
• ESET_Apt_Windows_TA410_Tendyron_Downloader

  TA410 Tendyron Downloader

  APT / acteurESET malware-ioc· ESET Research· 2020-12-09
• ESET_Apt_Windows_TA410_Tendyron_Installer

  TA410 Tendyron Installer

  APT / acteurESET malware-ioc· ESET Research· 2020-12-09
• ESET_Apt_Windows_TA410_X4_Hash_Fct

  Matches X4 hash function found in TA410 X4

  APT / acteurESET malware-ioc· ESET Research· 2020-10-09
• ESET_Apt_Windows_TA410_X4_Hash_Values

  Matches X4 hash function found in TA410 X4

  APT / acteurESET malware-ioc· ESET Research· 2020-10-09
• ESET_Kobalos

  Kobalos malware

  MalwareESET malware-ioc· Marc-Etienne M.Léveillé· 2020-11-02
• ESET_Kobalos_Ssh_Credential_Stealer

  Kobalos SSH credential stealer seen in OpenSSH client

  MalwareESET malware-ioc· Marc-Etienne M.Léveillé· 2020-11-02
• ESET_Apt_Windows_TA410_Flowcloud_Loader_Strings

  Matches various strings found in TA410 FlowCloud first stage.

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_IIS_Group12

  Detects Group 12 native IIS malware family

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_IIS_Group02

  Detects Group 2 native IIS malware family

  MalwareESET malware-ioc· ESET Research· 2021-08-04
• ESET_Apt_Windows_TA410_X4_Strings

  Matches various strings found in TA410 X4

  APT / acteurESET malware-ioc· ESET Research· 2020-10-09
• ESET_IIS_Native_Module_PRIVATE

  Signature to match an IIS native module (clean or malicious)

  GénériqueESET malware-ioc· ESET Research· 2021-08-04
• ESET_Apt_Windows_Invisimole_Wrapper_DLL

  Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_C2

  InvisiMole C&C servers

  APT / acteurESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_TA410_Flowcloud_V4_Resources

  Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Flowcloud_V5_Resources

  Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2

  APT / acteurESET malware-ioc· ESET Research· 2021-10-12
• ESET_IIS_Group09

  Detects Group 9 native IIS malware family

  MalwareESET malware-ioc· ESET Research· 2021-08-04