-
185.73.108.36 · 20251017-access.log.gz
Czechia · ISP Alliance a.s.Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: db29d12324e9f1fbdb36912e6774e582c29c7552 SHA256: 03c1545eb637f47deb12a1fa5ce97def549d99f348c4e20c3db5976fa5bee6c2 application/x-gzip 6.46KB
2025-10-18 22:01:02 +0000 UTC
-
185.73.108.36 · 20251015-access.log.gz
Czechia · ISP Alliance a.s.Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 5eb97a7f5fc2b3ff07cd05eb1910412b53cb7a96 SHA256: 9362390a892871c98641cad6769492ca6c0717c7fa7a8bf7155fc2e940aa5789 application/x-gzip 5.81KB
2025-10-16 22:01:04 +0000 UTC
-
185.73.108.36 · 20251008-access.log.gz
Czechia · ISP Alliance a.s.Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 18b8270077cf4f5f93a265f8e7f94b138f2a0059 SHA256: 0dcf15d268ea12c671db45b34724ff361ae1aa72fa6ccf54596bc9b60ac5c572 application/x-gzip 4.71KB
2025-10-09 22:01:02 +0000 UTC
-
185.73.108.36 · 20251006-access.log.gz
Czechia · ISP Alliance a.s.Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: c9fbf1a9c4bfd7ab6f5fef37c5b55ce42fa1d907 SHA256: d4746c9ef23d25f2a4c47f1fed876d9cf6f399132ec38c175a06f24794b9b632 application/x-gzip 5.70KB
2025-10-07 22:01:02 +0000 UTC
-
185.73.108.36 · 20251002-access.log.gz
Czechia · ISP Alliance a.s.Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 8c59a7f1f842aaf0dbabc299fb2d688eb3570c70 SHA256: 837495cac99e96acaf68f60188ec23904ae1d9d0552dc780e61da236ab5fd84f application/x-gzip 3.66KB
2025-10-03 22:01:03 +0000 UTC
-
185.73.108.36 · 20250922-access.log.gz
Czechia · ISP Alliance a.s.Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 174684c8bb80f136c399065467d0ba282e2ad530 SHA256: 2d053eb9e30911b1fc56b8803dafe3fae9258e9985c7cbb6c09f607db8dcd7bd application/x-gzip 4.11KB
2025-09-23 22:01:04 +0000 UTC
-
185.73.108.36 · 20250920-access.log.gz
Czechia · ISP Alliance a.s.Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 41f02467af161da01743aeaf99eb2a8f1340187d SHA256: aa1b7ee895803014dcffe67969dd782c1b70203618778961d21c9707f467beca application/x-gzip 4.19KB
2025-09-21 22:01:16 +0000 UTC
-
bk1.mywebtools.in · canadabiggestd1.tar.gz
/india/weekly/2025-07-26/accounts/
India · Contabo Asia Private LimitedYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 6c5182bd5baad25dc8c0297fbebd0e02ea014f88 SHA256: 633ecfd64940292b8eda5631bec720ff331f3ed16522a3820be5cb412e4a7c31 application/x-gzip 3.25MB
2025-07-26 02:22:31 +0000 UTC
-
bk1.mywebtools.in · canadabiggestd1.tar.gz
India · Contabo Asia Private LimitedYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 6c5182bd5baad25dc8c0297fbebd0e02ea014f88 SHA256: 633ecfd64940292b8eda5631bec720ff331f3ed16522a3820be5cb412e4a7c31 application/x-gzip 3.25MB
2025-07-26 02:22:31 +0000 UTC
-
144.76.151.206 · access_log.12.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 16ded65b92574cd51459cc8506af979b77981a2b SHA256: 5e42b8b876eca4a3594cae7b69e823e201ff20ff3fbaccc8b6fa98a1cb548db3 application/x-gzip 68.12KB
2025-04-14 05:06:45 +0000 UTC
-
144.76.151.206 · access_log.11.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 598ef38b66100124ba9e56e0e467b75d9d2fb41b SHA256: 340415690a8db221b3ce775ecdbb81c6a1b795ba74f784a738c818804d24923e application/x-gzip 44.56KB
2025-04-20 04:58:53 +0000 UTC
-
144.76.151.206 · access_log.10.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 71ae769a2ec39061ab158bef7f0cd8e84f74a38f SHA256: 6a5e8b9d4cc6b4a09f3fc259bf8b345b6f22979b276d80e014622113e93b0127 application/x-gzip 74.97KB
2025-04-27 05:14:18 +0000 UTC
-
144.76.151.206 · access_log.9.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 33fa277793406d4afeaf77f150e7bed4d523b4e2 SHA256: 4701bcf554bea5a20c3678cf65a843afca8dfb703fdc1573ca9f3761b1b12683 application/x-gzip 68.57KB
2025-05-05 05:16:09 +0000 UTC
-
144.76.151.206 · access_log.8.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 6a800dc2297ecb40198f8a6f5ef93606f50ec335 SHA256: e54c83c03f5940898aaa9e9e1ffc0342be1db586dbd01407196af4d6401a9b06 application/x-gzip 49.17KB
2025-05-11 04:30:00 +0000 UTC
-
144.76.151.206 · access_log.7.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 111c838a7cd9f1efc8a2e2560835a03f6f5f7342 SHA256: b3b11cb330dc4be83470fff47f654a6a9a930fc00c3b948baec5b58d6dfe1b36 application/x-gzip 57.76KB
2025-05-18 05:23:33 +0000 UTC
-
144.76.151.206 · access_log.6.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: df45f0aa16eada265abc7f2864d6e7fba5dfb08d SHA256: 618e7caf75fc0fd0fb9d6fbc72992ce9cc086d294fa5dd25e1c079231dd9d361 application/x-gzip 54.41KB
2025-05-25 04:48:19 +0000 UTC
-
144.76.151.206 · access_log.4.gz
/vhosts/dev.glascard.at/statistics/logs/
Germany · Hetzner Online GmbHYara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)Download archived sample
The password is "infected"SHA1: 189669d2c5f819e33e98754f328084278bf8f152 SHA256: 83d6281444b070d3d443c632b298023355519a2469fcfc26a4269256f54667a5 application/x-gzip 50.04KB
2025-06-08 05:04:13 +0000 UTC
-
akintuhafiye.com · akinttdb.zip
Türkiye · Verigom Telekomunikasyon Limited SirketiYara EXPL_Exchange_ProxyShell_Successful_Aug21_1 From Florian Roth by Florian Roth (Nextron Systems)Yara EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 From Florian Roth by Florian Roth (Nextron Systems)SHA1: a255fbc4c123b415cc6b73f0c0453d8b372cbb0c SHA256: f26ea6864a8f48c8d22700c9950ff1db19252cb951ee34f18d6e7e56bf8cca60 application/zip 537.48MB
2024-08-18 01:10:15 +0000 UTC