Trend Micro Solutions Customers of the Trend Micro™ TippingPoint™ solution are protected from this threat via these MainlineDV filters:  2573: MINER - TCP (Request)    Indicators of Compromise (IoCs)  File name SHA256 Detection rsync 0d71a39bbd666b5898c7121be63310e9fbc15ba16ad388011f38676a14e27809 Backdoor.Perl.SHELLBOT.AB ps bb1c41a8b9df7535e66cf5be695e2d14e97096c4ddb2281ede49b5264de2df59 Backdoor.Linux.SSHDOOR.AB cron 4efec3c7b33fd857bf8ef38e767ac203167d842fdecbeee29e30e044f7c6e33d Coinminer.Linux.MALXMR.UWEJN anacron 66b79ebfe61b5baa5ed4effb2f459a865076acf889747dc82058ee24233411e2 tsm32 0191cf8ce2fbee0a69211826852338ff0ede2b5c65ae10a2b05dd34f675e3bae Trojan.Linux.SSHBRUTE.A tsm64 085d864f7f06f8f2eb840b32bdac7a9544153281ea563ef92623f3d0d6810e87   URLs • 146[.]185[.]171[.]227:443   • C&C for Backdoor.Perl.SHELLBOT.AB - 5[.]255[.]86[.]129:3333   • C&C for Backdoor.Linux.SSHDOOR.AB - 54[.]37[.]70[.]249/.satan  • 54[.]37[.]70[.]249/rp  • hxxp://54[.]37[.]70[.]249/.x15cache  • hxxp://54[.]37[.]70[.]249/dota2.tar.gz  • hxxp://54[.]37[.]70[.]249/fiatlux-1.0.0.apk   • APK file hosted on this server - hxxp://mage[.]ignorelist[.]com/dota.tar.gz  • mage[.]ignorelist[.]com  • zergbase[.]mooo[.]com         Tags  Malware | APT & Targeted Attacks | Endpoints | Research