← IBM QRadar detectionsIBM QRadar · Indicator

Malicious Hashes

AQLhighconfidence 72/100generated 2026-10-18

QRadar reference set (AlphaNumeric (Ignore Case)) with the 45 current skopnix file hash indicators — the feed the "Skopnix: Known-malicious file hash observed" rule reads.

ATT&CK: T1204.002 mitre ↗
Linked actors: APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · global · GOLD CABIN · HAZY TIGER · Kimsuky · Kinsing · Mr_Rot13 · Predatory Sparrow · rhysida · RomCom · SaintBear · Scarab · TA402 · Tortoiseshell · Turla · Volt Typhoon · Water Sigbin · Whitefly · Winter Vivern · XDSpy
False positives: Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

Reference set spec

skopnix-qradar-ioc-refset-hash-2b78a86c.jsondownload .json ↓

{
 "name": "Skopnix: Malicious Hashes",
 "element_type": "ALNIC",
 "element_type_label": "AlphaNumeric (Ignore Case)",
 "time_to_live": "730 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20Malicious%20Hashes&element_type=ALNIC&time_to_live=730%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20Malicious%20Hashes  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "007a67bfa732084b3f8278b302bef49e",
  "0097b8722c8c0840e8c1a4dd579438344b3e6b4d630d17b0bbe9c55159f43142",
  "02a3296238a3d127a2e517f4949d31914c15d96726fb4902322c065153b364b2",
  "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01",
  "07d123364d8d04e3fe0bfa4e0e23ddc7050ef039602ecd72baed70e6553c3ae4",
  "10cec5a84943f9b0c635640fad93fd2a2469cc46aae5e43a4604c903d139970f",
  "1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad",
  "2286f126ab4740ccf2595ad1fa0c615c",
  "263dc5a8121d20403beeeea452b6f33d51d41c6842d9d19919def1f1cb13226c",
  "2e4671c517040cbd66a1be0f04fb8f2af7064fef2b5ee5e33d1f9d347e4c419f",
  "3eec65c8ac25682d9e7d293ca9033c8a841f4958",
  "3fb160e1770fafeedff2d77841bf02108c25cca4cb6d77e3fbf759077f356b70",
  "4180c193f366021f1c10890a5bcd2d3ecef47fa7",
  "4468edc18de42e61b64441c75aedcb15d553410d473e77fc8ae31b358acd506a",
  "508d106ea0a71f2fd360fda518e1e533e7e584ed",
  "561cb93118fef1966a3233ae7ffd31017823dd5aaad5dc1b2542e717055c197a",
  "5eaa1f5305f4c25292dff29257cd3e14ba3f956f6f8ddb206c0ee3e09af8244e",
  "62ecc8950e8be104e250304fdc32748fcadaeaa677f7c066be1baa17f940eda8",
  "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167",
  "69b3d913a3967153d1e91ba1a31ebed839b297ed",
  "6f47723e5fc6e96ab5e9f96f6bc585fa",
  "780965bad574e4e7f04433431d0d8f63",
  "7de8b8b314f2d2fb54f8f8ad4bba435e8fc58b894b1680e5028c90c0a524ccd9",
  "83130d95220bc2ede8645ea1ca4ce9afc4593196",
  "837e9bb07d884385d077d4ea77797df8",
  "884e96a75dc568075e845ccac2d4b4ccec68017e6ef258c7c03da8c88a597534",
  "925aff03ab009c8e7935cfa389fc7a34482184cc310a8d8f88a25d9a89711e86",
  "97ed594ef2b5755f0549c6c5758377c0b87cfae0",
  "99729ac323fc8a812fa2c8be9ae82df0f9b502ca",
  "9b281a8220a6098fefe1abd6de4fc126fddfa4f08ed1b90d15c9e0514d77e166",
  "a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2",
  "a8c28bd6f0f1fe6a9b880400853fc86e46d87b69565ef15d8ab757979cd2cc73",
  "b86678403d77efbdba3d2b1c93500dfc",
  "baeffeb5fdef2f42a752c65c2d2a52e84fb57efc906d981f89dd518c314e231c",
  "c38c21120d8c17688f9aeb2af5bdafb6b75e1d2673b025b720e50232f888808a",
  "c7ab300df27ad41f8d9e52e2d732f95479f4212a3c3d62dbf0511b37b3e81317",
  "caa7667bfdbcb04ceb9d81df93fe805dfe4ac8a04b9dd3eaab7b5f7c87c4fc9c",
  "d77421caae67f4955529f91f229b31317dff0a95",
  "d9ac9c950e5495c9005b04843a40f01fa49d5fd49226cb5b03a055232ffc36f3",
  "dafad19900fff383c2790e017c958a1e92e84f7bb159a2a7136923b715a4c94f",
  "eb2f5e1b8f818cf6a7dafe78aea62c93",
  "ef5400f6dbf32bae79edb16c8f73a59999e605c7",
  "f0551696774f66ad3485445d9e3f7214",
  "f6c77098906f5634789d7fd7ff294bfd95325d69f1be96be1ee49ff161e07733",
  "f71732f997c53fa45eef5c988697eb4aa62c8655d8f0be3268636fc23addd193"
 ]
}

45 elements · one per line for a bulk import ↓

How to deploy on IBM QRadar

1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References

skopnix.com/detections ↗