-
Notifications
You must be signed in to change notification settings - Fork 5
/
2022-04-12-IOCs-for-SpringShell-exploitation-by-Enemybot.txt
74 lines (68 loc) · 4.28 KB
/
2022-04-12-IOCs-for-SpringShell-exploitation-by-Enemybot.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
2022-04-12 (TUESDAY) - SPRINGSHELL EXPLOITATION BY ENEMYBOT
REFERENCE:
- https://twitter.com/Unit42_Intel/status/1513951086356406279
NOTE:
- At least 62 samples of Gafgyt-based Linux botnet, Enemybot, exploiting the SpringShell vulnerability, were spotted on VirusTotal on 2022-04-11 and 2022-04-12.
- The SHA256 file hashes are listed below.
00bc1ce81f79089670a7d2956df112ff29ee86d51ecad0d7fb5012d54cbfaf4a
01c758742f333d897b6d6fead725d91841f8a17bed6fb7fcc1226d7bd9a70c12
07177233647e1ff382dde4803bc0651e5b052112a5450bd78858d945c4bc2e0b
0801d8f5c028457b5bad66917d39d17471659eb522c5813f893c76bf4bc3148e
12be4047b17c39993ea540b7bd857a665be2e205d455d0664dd4a96d763348ce
12fd76f12e860d2931cc7e8b263933d9b82525f10116738fbd493c7666471cc5
1416877edd6c4b18cbca4598b4c91b023113c51e9e8dbaef2266254727f223dc
1adfc65c5ba75668d6f45e65ccb31100f9f8bf510435960b6038c7c7b746be62
1c441e606233bbac68175731b0f35c0760a2da8e4002ef3ea36f341cf342cc79
200c0d1c71d5c3faaba9ec5abcd1445b34c14fa66001557c11c574776b8baea7
208ffbdc18d19de0691d523fc3acddc1390223d8f5a5e62f2526e26626086c38
23e718def31c7a37bcbfae15a4eb0725e106f7b73b238d9ae42a19036e618dd7
27b5e1f1bbde28fbd2d6d31f64a1b96c32d064a23f5832c7f6b04f32886c1929
2c91a412ecedf9e6998997d90467398e2a55373c0b9b3395848184210705d7e6
2ec4d6fad356e771ecc18491d931c3cf510e10d3ff49d8ab06e0da0e5eb8d120
2f08cab642d4da5ab2a1d9ed6e816b5dd20bff21b10b7014d0ff19bde5b7890f
336008e2b7f2bf194a44984b36d0594d03103e3636540273eed82c01af407001
3b1bbec6edbaf072ef57fa257279497e74ebf80ff038d21a4043ac79656d7e28
3d73aea855fc012e2a49a4c98f293dc4836a284ddf7481486b9948f6b6adbc00
4485c594dce7c8444c2d9fbffc180a44795c98531d41ebd9a46f76ca052c8fa3
4aa7b83b9d83db23b2a3dbfb6078a866928fc61655d0bc8ecc2fce5c3679c6b4
4c31d578ad4bac892f0dcb307080f24196360765fe007c316c6f1878f9310d03
4dc210da4efc55c32442a87eeeb3c45fc1e4001a99536503698708ff668ff262
563cb8c26e7a5867f24f3ba21ad1d7cf923703e02788a96984c6a7f38f2d481e
57594c0ebdf7365f6ccd6a576f32870e14bd87e627789de43626093e51d63050
59845f9e4a5ad158c9021dbe7dcdec5ec7fe388549c01ca6207badfb24133d2b
5b266c9bd119725dda27c91c08dd3b61659f2b91a487b420b21514f3235cbbb9
5d38e81de505e6eeb887e10566ac09796db4bfeb9f4c13054c490064f1ff2eba
5dc6318d8d50fb903ee4a79080769fd25a04ec6633cab32b0f890875c0780290
5f6b65a372bfe982bca49e99f1ba17a57cbb5976a007bc07f1f645a2e9e6c22a
631ddce47e2af455dcd985eb5f5e3fd8319b16b3db97b8ed915bba077d12ce49
6381ea65b83ea2e2a4eed2c9f6fe6c2b0e31d4df2daf8201fa901782bfa5b019
65dbdc04b1574683304457cd7c78541ead165201f89a1b2a7285313bc9b08bff
72d34977b8f4b4734e89da4a1e8a9468173b69364ebf6150ab0fe3605123e98e
73808dc4480bf696a4abc90c41b988886a6fa749c0b56098958471bb9c867af7
81891ec2d391fb3ef95f04aa7c13cd99a7c4f939fec7ccddada2dc4811b78411
8f8f61f95649f523e12533051dd55dd0d4da84da56873cb544dd12f01ea81ee0
9482dccd63983272e610041d4bbf262b9e2ac23d721c097074e405fcd9a897c0
97684ae157687ede7bf91bebe6d495da66e8496c0c273255a8e6134697994966
98121e22dcb0b5ff2a05e49072b623ffd497b08c655ad200352b8fbfd94f4bc3
9936afc821410d4ee8cc0a3d0bce6ef6b490392f4f13ae31f84a94c959a2fc03
a00f249d4d86941b2b2d66c3431467ae8abac4ef8111c3b9d0f5b631e07d702b
b11676e7e98d54c983b87a6e69054e70670169bdba0bf440eafcf06267b485b3
b351a8b608f6e223ad8afd75d2f7121a4c7eec04ae1fd501619204bdac35a8ba
b3f05948bdcff16464125fbb87bd6dab3b55510b8ed093abb37a7ba2b7e78297
c1566f52e2f69008aa9afd6ea9a82972bdf2a51d90a7a85842858134ea74de40
c3bff052096f85673dcbdf9038114d55b9a7b9b84b4049caee5612d50a8a734b
c495527a844ddb6220ec8c333477e8d630b7552db38082a32f692f3b892ca9ce
cadac6b80362ccc22e5f25ec1c57c43d66c893539306193a271ad78afa7d47c0
d1f4dfba13d5407d367a847f213826f3a434e7af8f3daae482909473550c4e89
d437b362e0bade3bdbb0e0e729b28b0068225671eda83df4309cea5898353289
dd607c9a74ce0183b94b06e550f77814678c23cb11c67841e5a75c842c36c0ad
e880481a7a40b7b13dc50241646d64a61814c11f0e7edb65006fc61da4f9f52a
ea0762fbdd49c6be02ef533ca14c8f33303ce21f3510ab12b1164a2299480cfe
edff8ce767dcec6300e05e7eb0712ab25673571503c2ac68690c7d257d2b2e29
efc1fc9efefb96e31f887681bcdea337c3ab3312b4d55c7541b1e7f272a1bf41
effddfe0e246b069f48e91e03dcd361998b773283834d9ebfd9703369bf663e4
f0b828e78df7156fd9213947c1542e9aedcb797595da5374bce05cc5af5c8255
f0cd9e36e2cdf45e59efab2761d606debd085fb7a6477b8be0e3cc813a279d42
f566e89c45af2300900a522ab004bb1ac1a63301f4dac99e0de85ac5a2aa83f6
f97d74ac49a75219ac40e8612a0ec0a829ed9daac2d913221115562c219c99b7
fd07ef316187f311bec7d2ff9eb793cc3886463ebae9445c9f89903b66727832