IOC du rapport source : https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/
Affichage neutralisé. Un observable associé n'est pas une preuve de compromission ni une consigne de blocage.
domain	amzaonaws[.]org	active
domain	microsoftupdates[.]top	active
domain	microupdate[.]me	active
domain	microupdate[.]top	active
domain	windefender[.]net	active
domain	windowsupdates[.]us	active
ipv4	103[.]215[.]216[.]116	revoked
ipv4	103[.]215[.]216[.]117	revoked
ipv4	103[.]215[.]216[.]162	revoked
ipv4	103[.]215[.]216[.]181	revoked
ipv4	103[.]215[.]216[.]27	revoked
ipv4	103[.]215[.]216[.]61	revoked
ipv4	103[.]215[.]216[.]75	revoked
ipv4	103[.]87[.]9[.]148	revoked
ipv4	130[.]94[.]91[.]165	revoked
ipv4	130[.]94[.]91[.]53	revoked
ipv4	146[.]71[.]85[.]33	revoked
ipv4	154[.]205[.]137[.]88	revoked
ipv4	180[.]149[.]44[.]110	revoked
ipv4	180[.]149[.]44[.]115	revoked
ipv4	180[.]149[.]44[.]43	revoked
ipv4	185[.]163[.]2[.]100	revoked
ipv4	185[.]163[.]2[.]34	revoked
ipv4	185[.]163[.]2[.]79	revoked
ipv4	185[.]163[.]2[.]81	revoked
ipv4	2[.]56[.]166[.]139	revoked
ipv4	2[.]56[.]166[.]84	revoked
ipv4	38[.]54[.]110[.]44	revoked
ipv4	38[.]54[.]71[.]107	revoked
ipv4	38[.]54[.]71[.]56	revoked
ipv4	45[.]67[.]230[.]185	revoked
ipv4	45[.]80[.]208[.]232	revoked
ipv4	89[.]44[.]198[.]107	revoked
ipv4	92[.]38[.]169[.]152	revoked
md5	40637c70fd5cd899ca41d1252c267ccf	active
sha1	71d3832587a1d009ca3c0947005b187f23e52008	active
sha1	b6df18f66cf4364be2946d6b981e69763aafde68	active
sha1	c8e585c8a161b9b7a0e59bd65a3ec5492375d53c	active
sha1	dbbcb279a1f1a258832174ce63c295c5080de249	active
sha256	0c1666b274ddb44dd5c7a11f03c8c041f6bccf0c7dae924626ef9d15b1cc41d5	active
sha256	129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427	active
sha256	4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59	active
sha256	50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8	active
sha256	6678216ace0ff224d6a5ae6bf1ca29e66fba9fceaa715e27440e85d5bfb06069	active
sha256	8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf	active
sha256	9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4	active
sha256	aa2fd252a6f5a09b8d8422fbd1037febefe2aa99317e3c3973889384a80e29b7	active
sha256	cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae	active
sha256	dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9	active
url	hxxp[:]//windefender[.]net[:]443	revoked
url	hxxp[:]//windowsupdates[.]us[:]80	revoked
url	hxxp[:]//www[.]windefender[.]net[:]443	revoked