IOC du rapport source : https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/
Affichage neutralisé. Un observable associé n'est pas une preuve de compromission ni une consigne de blocage.
md5	94b50ace73cc03790678c73b867be129	active
md5	be860a15b7e5d44b0b3d67f598238fad	active
md5	c024189e1e7fa0ae6d24353367e8b98d	active
md5	ed276b2312f641b00f87fa18e85c48eb	active
md5	f1d2fdb7f3b699da69a050c5352a33c2	active
md5	f94de28bd66afc4679f546500db184d4	active
sha1	608c34e10713278fbe80b7cb5dedb0555cff1559	active
sha1	d2a98fe01257d897a0dc5994392cbde9089fadf9	active
sha256	39368a9465aca3286e4436650b7a33b39a9294a81f3e681e056c9da0550e27c4	active
sha256	9839448acc050331b5713882a25b863b47993a0f2859b4820563e34c72f5b679	active