Vulnerability in Openfire messaging software allows unauthorized access to compromised servers ― Indicators of compromise

Samples

Detection name	SHA-1
JSP.BackDoor.8	41d2247842151825aa8001a35ee339a0fef2813f
JSP.BackDoor.8	0c6249feee3fef50fc0a5a06299c3e81681cc838
JSP.BackDoor.8	62ea0fce2716006d16a1408cda159cf20f90004e
JSP.BackDoor.8	33c11e7b2b3950a430cf3b40128429d9b723103c
Linux.BtcMine.546	e545ceffc8948e3ca9900212807cf3a862d33581
Linux.BackDoor.Tsunami.1395	61586a0c47e3ae120bb53d73e47515da4deaefbb

Network indicators

IPs

185[.]17[.]0[.]226
129[.]159[.]207[.]181