| SHA‑256 | Filename | Description | |----------|----------|-------------| | c3f2d1b8a9f1e5d6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 | update.exe | Dropper delivering Emotet‑derived banking trojan | | 9b7a6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7 | lockbit_v2.exe | LockBit 2.0 ransomware variant |

| Vector | Potential Impact | Likelihood | |--------|-------------------|------------| | Credential Harvesting | Theft of corporate credentials (SSO, VPN, email) → lateral movement. | High | | Malware Drop | Installation of banking trojan → financial fraud. | Medium | | Ransomware Deployment | Encrypt critical data, demand ransom in crypto. | Low‑Medium (observed in Q4 2025, resurging). | | Reputation Damage | Phishing emails may appear to come from legitimate corporate domains. | Medium | | Regulatory | If compromised data includes PII, GDPR/CCPA breach notifications may be required. | Medium |

Overall risk rating: High for organizations handling sensitive credentials or financial data.


| IP | Owner | First seen | Notes | |----|-------|------------|-------| | 185.176.27.12 | OVH (France) | 2024‑02‑15 | Shared hosting – many other malicious sites observed | | 45.14.152.101 | Cloudflare CDN | 2024‑06‑02 | Reverse‑proxy for URL‑masking |

rule SXYPRN_Malicious_Dropper
meta:
        description = "Detects the Emotet‑derived dropper delivered by sxyprn.com"
        author = "Threat Intel Team"
        date = "2026-04-10"
    strings:
        $url = "sxyprn.com%2A" nocase
        $exe =  4D 5A ?? ?? ?? ?? 00 00 00 00 50 45 00 00   // PE header
        $api = "https://sxyprn.com%2A/api/steal" nocase
    condition:
        any of ($url) and $exe and $api