T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers

    Friday, November 13, 2026 In: Threat Research Print

    Date: 11/13/2026

    Severity: High

    Summary

    In October 2026, Labs observed a malware operation that exploits publicly accessible Microsoft SQL Server systems to deploy malicious payloads. The malware scans IP ranges for exposed SQL Servers and attempts to gain access using supplied credentials. Once authenticated, it executes malicious T-SQL commands remotely to download and launch additional payloads. The investigation examines the full infection process, covering IP range discovery, supporting file downloads, persistence techniques, and the misuse of T-SQL commands to deliver further malware. Two malicious files were identified: “MicrosoftEdgeUpdate.exe,” an XMRig miner that uses the server’s CPU to mine Monero, and “winlogon.exe,” a Gh0st RAT. The RAT supports keylogging, screen capture, file management, remote shell access, and over 30 commands to control compromised Microsoft SQL Servers.

    Indicators of Compromise (IOC) List

    Domains/URLs

    site.vietnam852.com:88

    ftp.vietnam852.com:88

    server.vietnam852.com:8000

    www.swordaa.com:8000

    site.hfgjjkrewjk.com

    site.jiancai008.com

    http://site.vietnam852.com:88/2026/2018.sql

    http://site.vietnam852.com:88/2026/dwm.exe

    http://site.vietnam852.com:88/2026/go.bat

    http://site.vietnam852.com:88/2026/go.vbs

    http://site.vietnam852.com:88/2026/out.bat

    http://site.vietnam852.com:88/2026/pass.txt

    http://site.vietnam852.com:88/2026/sqlcmd.exe

    http://site.vietnam852.com:88/2026/user.txt

    http://site.vietnam852.com:88/down.exe

    http://site.vietnam852.com:88/ip.php

    http://ftp.vietnam852.com:88/post.php

    http://site.jiancai008.com:88/test/dllhost.exe

    http://site.jiancai008.com:88/test/winlogon.exe

    http://site.jiancai008.com:88/test/WinRing0x64.sys

    http://site.jiancai008.com:88/test/MicrosoftEdgeUpdate.exe

    http://ftp.vietnam852.com:88/test/WinRing0x64.sys

    http://ftp.vietnam852.com:88/test/MicrosoftEdgeUpdate.exe

    http://ftp.vietnam852.com:88/test/winlogon.exe

    http://ftp.vietnam852.com:88/test/dllhost.exe

    http://ftp.vietnam852.com:88/test/sihost.exe

    http://site.vietnam852.com/tj/xmr.php?data=

    http://site.hfgjjkrewjk.com/tj/xmr.php?data=

    Hash

    8CE2CD98EF6CEEECE8239936E4AEA042C41807F632CD691D5091705BF6C0076D

    F5444E8E9E9E019693AACB363B7441AC0B8ECFE96A77FD94B9C312A017588EB4

    2A0D2889241885D5EA6FE7DD1B1ADC83653A0C07B8AAA1B0832E5F9C0225B379

    79596CF6E267EF5CB658BD97D04E42A41001D36595E370441ADB3C2B5DD5666C

    E9D3FD9093C476B8B5DE19AA00C50758568649DEF6491F54FA3E0ABA4EA31AC9

    D6E3FD28F479138B336E2C2088AD2E86B7646A163AA453B1703905A4B359070F

    124774698FD3EDE0800015D19C2BD6C1869D03BBC2E6E8DBE2F69D2978F7F4D0

    125D3A0EFE7699BB20397C13F0F4993AD893952727487B4D190E386A5B14C427

    20983573B840447E1AACD6D3F6DD240732B15037D268D6456F0D3C4EC5051CB0

    58DB0CA2054ABE2989412D7A1C8ED16718577F893C196825C848FCD56C7E8F05

    2A23E10BFC097E98295CBFF8124BD403C4CB677E709B48CCC53D6ACA216C3061

    DA4128AA5D006E05C58F0D240C2D8E5FB02774B6ACF314F1230059C7A3498724

    3F64B0146B323C5716043360E84384A5A197A897F46088DF93A910470A29E1A0

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "http://site.vietnam852.com:88/2026/2018.sql" or url like "http://site.vietnam852.com:88/2026/2018.sql" or siteurl like "http://site.vietnam852.com:88/2026/2018.sql" or domainname like "http://site.vietnam852.com:88/2026/go.vbs" or url like "http://site.vietnam852.com:88/2026/go.vbs" or siteurl like "http://site.vietnam852.com:88/2026/go.vbs" or domainname like "http://site.vietnam852.com:88/down.exe" or url like "http://site.vietnam852.com:88/down.exe" or siteurl like "http://site.vietnam852.com:88/down.exe" or domainname like "http://site.hfgjjkrewjk.com/tj/xmr.php?data=" or url like "http://site.hfgjjkrewjk.com/tj/xmr.php?data=" or siteurl like "http://site.hfgjjkrewjk.com/tj/xmr.php?data=" or domainname like "http://site.vietnam852.com/tj/xmr.php?data=" or url like "http://site.vietnam852.com/tj/xmr.php?data=" or siteurl like "http://site.vietnam852.com/tj/xmr.php?data=" or domainname like "http://ftp.vietnam852.com:88/test/MicrosoftEdgeUpdate.exe" or url like "http://ftp.vietnam852.com:88/test/MicrosoftEdgeUpdate.exe" or siteurl like "http://ftp.vietnam852.com:88/test/MicrosoftEdgeUpdate.exe" or domainname like "http://site.vietnam852.com:88/2026/out.bat" or url like "http://site.vietnam852.com:88/2026/out.bat" or siteurl like "http://site.vietnam852.com:88/2026/out.bat" or domainname like "http://site.vietnam852.com:88/2026/pass.txt" or url like "http://site.vietnam852.com:88/2026/pass.txt" or siteurl like "http://site.vietnam852.com:88/2026/pass.txt" or domainname like "http://ftp.vietnam852.com:88/test/winlogon.exe" or url like "http://ftp.vietnam852.com:88/test/winlogon.exe" or siteurl like "http://ftp.vietnam852.com:88/test/winlogon.exe" or domainname like "site.hfgjjkrewjk.com" or url like "site.hfgjjkrewjk.com" or siteurl like "site.hfgjjkrewjk.com" or domainname like "site.jiancai008.com" or url like "site.jiancai008.com" or siteurl like "site.jiancai008.com" or domainname like "http://site.vietnam852.com:88/2026/sqlcmd.exe" or url like "http://site.vietnam852.com:88/2026/sqlcmd.exe" or siteurl like "http://site.vietnam852.com:88/2026/sqlcmd.exe" or domainname like "http://site.jiancai008.com:88/test/dllhost.exe" or url like "http://site.jiancai008.com:88/test/dllhost.exe" or siteurl like "http://site.jiancai008.com:88/test/dllhost.exe" or domainname like "http://site.jiancai008.com:88/test/MicrosoftEdgeUpdate.exe" or url like "http://site.jiancai008.com:88/test/MicrosoftEdgeUpdate.exe" or siteurl like "http://site.jiancai008.com:88/test/MicrosoftEdgeUpdate.exe" or domainname like "http://ftp.vietnam852.com:88/test/dllhost.exe" or url like "http://ftp.vietnam852.com:88/test/dllhost.exe" or siteurl like "http://ftp.vietnam852.com:88/test/dllhost.exe" or domainname like "http://site.vietnam852.com:88/2026/user.txt" or url like "http://site.vietnam852.com:88/2026/user.txt" or siteurl like "http://site.vietnam852.com:88/2026/user.txt" or domainname like "http://site.vietnam852.com:88/ip.php" or url like "http://site.vietnam852.com:88/ip.php" or siteurl like "http://site.vietnam852.com:88/ip.php" or domainname like "http://ftp.vietnam852.com:88/post.php" or url like "http://ftp.vietnam852.com:88/post.php" or siteurl like "http://ftp.vietnam852.com:88/post.php" or domainname like "http://ftp.vietnam852.com:88/test/WinRing0x64.sys" or url like "http://ftp.vietnam852.com:88/test/WinRing0x64.sys" or siteurl like "http://ftp.vietnam852.com:88/test/WinRing0x64.sys" or domainname like "http://site.jiancai008.com:88/test/winlogon.exe" or url like "http://site.jiancai008.com:88/test/winlogon.exe" or siteurl like "http://site.jiancai008.com:88/test/winlogon.exe" or domainname like "http://site.jiancai008.com:88/test/WinRing0x64.sys" or url like "http://site.jiancai008.com:88/test/WinRing0x64.sys" or siteurl like "http://site.jiancai008.com:88/test/WinRing0x64.sys" or domainname like "http://site.vietnam852.com:88/2026/dwm.exe" or url like "http://site.vietnam852.com:88/2026/dwm.exe" or siteurl like "http://site.vietnam852.com:88/2026/dwm.exe" or domainname like "http://site.vietnam852.com:88/2026/go.bat" or url like "http://site.vietnam852.com:88/2026/go.bat" or siteurl like "http://site.vietnam852.com:88/2026/go.bat" or domainname like "http://ftp.vietnam852.com:88/test/sihost.exe" or url like "http://ftp.vietnam852.com:88/test/sihost.exe" or siteurl like "http://ftp.vietnam852.com:88/test/sihost.exe" or domainname like "site.vietnam852.com:88" or url like "site.vietnam852.com:88" or siteurl like "site.vietnam852.com:88" or domainname like "ftp.vietnam852.com:88" or url like "ftp.vietnam852.com:88" or siteurl like "ftp.vietnam852.com:88" or domainname like "server.vietnam852.com:8000" or url like "server.vietnam852.com:8000" or siteurl like "server.vietnam852.com:8000" or domainname like "www.swordaa.com:8000" or url like "www.swordaa.com:8000" or siteurl like "www.swordaa.com:8000" 

    Detection Query 2 :

    sha256hash IN ("124774698FD3EDE0800015D19C2BD6C1869D03BBC2E6E8DBE2F69D2978F7F4D0","125D3A0EFE7699BB20397C13F0F4993AD893952727487B4D190E386A5B14C427","2A23E10BFC097E98295CBFF8124BD403C4CB677E709B48CCC53D6ACA216C3061","DA4128AA5D006E05C58F0D240C2D8E5FB02774B6ACF314F1230059C7A3498724","E9D3FD9093C476B8B5DE19AA00C50758568649DEF6491F54FA3E0ABA4EA31AC9","79596CF6E267EF5CB658BD97D04E42A41001D36595E370441ADB3C2B5DD5666C","D6E3FD28F479138B336E2C2088AD2E86B7646A163AA453B1703905A4B359070F","3F64B0146B323C5716043360E84384A5A197A897F46088DF93A910470A29E1A0","8CE2CD98EF6CEEECE8239936E4AEA042C41807F632CD691D5091705BF6C0076D","20983573B840447E1AACD6D3F6DD240732B15037D268D6456F0D3C4EC5051CB0","2A0D2889241885D5EA6FE7DD1B1ADC83653A0C07B8AAA1B0832E5F9C0225B379","58DB0CA2054ABE2989412D7A1C8ED16718577F893C196825C848FCD56C7E8F05","F5444E8E9E9E019693AACB363B7441AC0B8ECFE96A77FD94B9C312A017588EB4")

    Reference:    

    T-SQL Abused to Deliver Malware Through Compromised MS SQL Servers                                                                              


    Tags

    MalwareRATMicrosoftExploitGhost RATMoneroKeyloggerScreen capture

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.