2022-03-17_Log4Shell-Horizon-Miner

Explotació masiva de VMWare Horizon vía Log4Shell para instalación de Cryptominer

IP origen:
139.99.241.160

Rogue LDAP:
135.125.146.221:1389

Payloads Minero:
http://150.129.234.203:82/add.bat
http://150.129.234.203:82/mad.bat
http://150.129.234.203:82/pr.bat
http://150.129.234.203:82/prx.bat
http://150.129.234.203:82/un.bat
http://150.129.234.203:82/7za.exe
http://150.129.234.203:82/dom-6.zip

dom-6.zip
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 *WinRing0x64.sys
bdec0d2ea20decc25659f26c7bfd7a78fb0e51cc100443b8a35c43206d2eb86a *benchmark_10M.cmd
8d26568f8d874053ad68dd1f4510a85ae61045e0945c33599dabd461fae7e835 *benchmark_1M.cmd
2c923d8b553bde8ce3167fe83f35a40a712e2bed2b76ebaf5e3e63642d551389 *config.json
02ed7c9449e9f7c92709edc9e687e66c0e5ab012196eb90ef5071a2d698af62e *pool_mine_example.cmd
8fee5933daad325e9c9f7c47a76c1471627456f7c4deef0f8d8ebfa37fcb446e *rtm_ghostrider_example.cmd
6e87f8c30fe0ef0035227ed01d3824223b72c9a196bdcd3202bb0a533d0ea804 *solo_mine_example.cmd
9554e811347798d784bbe0ed5fa212e95dc8783a34cbc298454805f0988cb577 *start.cmd
366b32c15ff2b30da5cafc1407e6dc49aa4bbecffc34c438302022acd1c00b8e *xmrig.exe