Exact SHA-256 indicator attribution

ESET malware-ioc, Copyright (c) 2014-2018 ESET spol. s r.o.
https://github.com/eset/malware-ioc
Snapshot commit: 17baf44964a77368e9149f4f593eb098beddf1c5
License: BSD-2-Clause (LICENSE-ESET.txt)
Derived only from samples.sha256 files. Deduplicated and labelled by source directory.

Stalkerware Indicators of Compromise by Échap and contributors
https://github.com/AssoEchap/stalkerware-indicators
Snapshot commit: e25fba7b16884956bc048a6e59fddc827606f560
License: CC BY 4.0 https://creativecommons.org/licenses/by/4.0/
(LICENSE-CC-BY-4.0.txt)
Derived from samples.csv SHA256 records whose App is listed as stalkerware in ioc.yaml.
Watchware, domains, package identifiers and signing certificates are not file signatures.

Changes: converted to a sorted, deduplicated TSV SHA-256 lookup with source labels.
Snapshot assembled 8 October 2026. No endorsement by data providers is implied.
No malware samples were downloaded. These sources do not guarantee complete coverage.
An exact match confirms a published fingerprint, not execution or active infection.
The broader Hypatia Bloom filters remain probabilistic screening only.
The exact index is shipped with APK releases; legacy .rsu bundles update the Bloom layer.
