Essential information

Value / Name

9eaafa5d2ef78e31bc6f5d9a6e18d191b6f7ddc5

Confidence

100/100

Revoked

Yes

Valid from

28/03/2023 21:08

Valid until

30/06/2024 21:08

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 23:42

Author / Source

AlienVault

Description

No description.

Pattern

rule sqlcmd_loader {   
       meta:   
           author = "@luc4m"   
           date = "2023-03-26"   
           hash_md5 = "6ffbbca108cfe838ca7138e381df210d"   
           link = "https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1"   
           tlp = "WHITE"   
       strings:   
           $trait_0 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 ec 04 00 00}   
           $trait_1 = {85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 9f 04 00 00}   
           $trait_2 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 7d 04 00 00}   
           $trait_3 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 5b 04 00 00}   
           $trait_4 = {6a 20 59 2b d9 03 f1 03 d1 3b d9 0f 83 5f fb ff ff}   
           $trait_5 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 e3 03 00 00}   
           $trait_6 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 c1 03 00 00}   
           $trait_7 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 9f 03 00 00}   
           $trait_8 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 4c 03 00 00}   
           $trait_9 = {33 c9 85 ff 0f 9f c1 8d 0c 4d ?? ?? ?? ?? 85 c9 0f 85 2a 03 00 00}   
    $str_0 = /debug[0-9]{1,3}\.ps1/i wide   
    $str_1 = "%s\\\\sysnative\\\\%s" wide   
    $str_2 = "/c \\\"powershell " wide   
    $str_3 = "%s/ab%d.exe" wide    
    $str_4 = "%s/ab%d.php" wide    
       condition:   
           (5 of ($trait_*)) and (3 of ($str_*))   
   }

Labels / Tags

Labels: binary curve25519 loaders maas nullmixer powershell seo poisoning trojan

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.