{"id":845092,"date":"2026-09-10T18:18:34","date_gmt":"2026-09-10T17:18:34","guid":{"rendered":"https:\/\/www.stormshield.com\/?p=845092"},"modified":"2026-09-10T18:18:44","modified_gmt":"2026-09-10T17:18:44","slug":"cti-melofee-linux-implant-nouveaux-variants","status":"publish","type":"post","link":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/","title":{"rendered":"M\u00e9lof\u00e9e : retour sur un implant Linux et ses nouveaux variants"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><p>[vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_column_text css=\"\"]<strong>M\u00e9lof\u00e9e revient, et il a \u00e9volu\u00e9\u00a0! Trois ans apr\u00e8s sa d\u00e9couverte, de nouveaux \u00e9chantillons de cet implant Linux se r\u00e9v\u00e8lent nettement plus sophistiqu\u00e9s\u00a0: d\u00e9composition en modules, chargeables et d\u00e9chargeables \u00e0 chaud, des fonctionnalit\u00e9s de shell, de fichiers et d'ex\u00e9cution de commandes, reconfiguration \u00e0 distance de l'infrastructure C2 et toujours une grande furtivit\u00e9 gr\u00e2ce \u00e0 un rootkit noyau. Stormshield documente ici la r\u00e9tro-ing\u00e9nierie compl\u00e8te de ces variants, l\u00e8ve le voile sur deux clusters d'infrastructure arm\u00e9s de certificats factices, et \u00e9tablit avec une confiance \u00e9lev\u00e9e un lien de filiation avec d'autres familles d'implants ciblant Windows.<br \/>\n<\/strong><\/p>\n<h2>Contexte<\/h2>\n<p>M\u00e9lof\u00e9e est une famille de malware ciblant les syst\u00e8mes Linux, document\u00e9e pour la premi\u00e8re fois en 2023 [<a href=\"https:\/\/blog.exatrack.com\/melofee\/\" target=\"_blank\" rel=\"noopener\">1<\/a>] et attribu\u00e9e \u00e0 des groupes d'attaquants avanc\u00e9s probablement li\u00e9s \u00e0 des int\u00e9r\u00eats \u00e9tatiques chinois.<\/p>\n<p>Lors d'une investigation, nous avons identifi\u00e9 de nouveaux \u00e9chantillons li\u00e9s \u00e0 cette famille.<\/p>\n<p>Nous pr\u00e9senterons dans cet article <strong>les nouvelles fonctionnalit\u00e9s des implants montrant une modularisation accrue du code, ainsi qu'une \u00e9volution des protocoles de communication support\u00e9s.<\/strong> Au travers de cet article, nous montrerons que ces nouveaux \u00e9chantillons partagent des similitudes importantes avec des codes existants tels que <em>CrowDoor<\/em>, <em>Hemigate<\/em>, ou <em>RatelS<\/em>. Ces similitudes nous permettent d'\u00e9valuer que ces diff\u00e9rents codes sont tr\u00e8s probablement partag\u00e9s entre plusieurs groupes d'attaquants li\u00e9s \u00e0 des int\u00e9r\u00eats \u00e9tatiques chinois.<\/p>\n<h2>M\u00e9lof\u00e9e depuis 2023 : contexte et \u00e9tat de l'art<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-845104 size-full\" src=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image1-vfr.jpg\" alt=\"\" width=\"800\" height=\"1176\" srcset=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image1-vfr.jpg 800w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image1-vfr-204x300.jpg 204w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image1-vfr-697x1024.jpg 697w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image1-vfr-768x1129.jpg 768w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image1-vfr-700x1029.jpg 700w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Les chercheurs d\u00e9crivaient alors <strong>une famille de malware ciblant les serveurs Linux,<\/strong> attribu\u00e9e avec un niveau de confiance \u00e9lev\u00e9 \u00e0 des groupes d'attaquants li\u00e9s \u00e0 la Chine, notamment des acteurs proches de APT41 [<a href=\"https:\/\/blog.exatrack.com\/melofee\/\" target=\"_blank\" rel=\"noopener\">1<\/a>, <a href=\"https:\/\/attack.mitre.org\/groups\/G0096\/\" target=\"_blank\" rel=\"noopener\">15<\/a>].<\/p>\n<p>L'analyse de trois \u00e9chantillons d\u00e9couverts en 2022 a mis en \u00e9vidence l'\u00e9volution continue de l'implant, caract\u00e9ris\u00e9e par l'int\u00e9gration progressive d'un rootkit noyau bas\u00e9 sur le projet open source Reptile, lequel a ensuite \u00e9t\u00e9 examin\u00e9 par AhnLab en juillet 2023\u00a0[<a href=\"https:\/\/asec.ahnlab.com\/en\/55785\/\" target=\"_blank\" rel=\"noopener\">3<\/a>].<\/p>\n<p>D\u00e8s cette premi\u00e8re analyse, M\u00e9lof\u00e9e pr\u00e9sentait plusieurs fonctionnalit\u00e9s caract\u00e9ristiques des implants Linux modernes\u00a0:<\/p>\n<ul>\n<li>Ex\u00e9cution de commandes \u00e0 distance\u00a0;<\/li>\n<li>Gestion de fichiers\u00a0;<\/li>\n<li>Ouverture d'un shell interactif\u00a0;<\/li>\n<li>Collecte d'informations syst\u00e8me\u00a0;<\/li>\n<li>Communication avec des serveurs de commande et contr\u00f4le (C2)\u00a0;<\/li>\n<li>M\u00e9canismes de persistance.<\/li>\n<\/ul>\n<p>L'analyse de l'infrastructure li\u00e9e \u00e0 M\u00e9lof\u00e9e a \u00e9galement permis d'identifier des liens avec plusieurs outils d\u00e9j\u00e0 observ\u00e9s dans des campagnes associ\u00e9es \u00e0 des groupes APT chinois, notamment ShadowPad, HelloBot, PlugX, Spark, Cobalt Strike et StowAway [<a href=\"https:\/\/blog.exatrack.com\/melofee\/\" target=\"_blank\" rel=\"noopener\">1<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf\" target=\"_blank\" rel=\"noopener\">11<\/a>].<\/p>\n<p>En novembre 2024, XLab (Qianxin) a publi\u00e9 une analyse [<a href=\"https:\/\/blog.xlab.qianxin.com\/analysis_of_new_melofee_variant_en\/\" target=\"_blank\" rel=\"noopener\">4<\/a>] d'un nouveau variant ciblant les syst\u00e8mes RHEL 7.9. Cette publication confirme la poursuite du d\u00e9veloppement de l'implant depuis sa d\u00e9couverte, avec plusieurs \u00e9volutions techniques d\u00e9taill\u00e9es dans la suite de ce document. Les chercheurs notent \u00e9galement le nombre limit\u00e9 d'\u00e9chantillons disponibles, ce qui sugg\u00e8re un usage restreint \u00e0 des cibles sp\u00e9cifiques.<\/p>\n<h2>\u00c9volutions entre les versions 2023 et 2024<\/h2>\n<p>Le fonctionnement principal de l'implant reste similaire entre les diff\u00e9rentes versions. Les m\u00eames commandes de base sont pr\u00e9sentes, avec uniquement une renum\u00e9rotation des identifiants de commande entre les versions.<\/p>\n<p>Plusieurs \u00e9volutions apparaissent toutefois entre les \u00e9chantillons de 2023 et le variant observ\u00e9 en 2024\u00a0:<\/p>\n<ul>\n<li><strong>Gestion des processus\u00a0:<\/strong> la version 2024 ajoute des commandes permettant de lister et de terminer des processus\u00a0;<\/li>\n<li><strong>Persistance :<\/strong> le m\u00e9canisme \u00e9volue avec l'utilisation de t\u00e2ches crontab, l'utilisation d'un fichier de service systemd se faisant passer pour un service l\u00e9gitime vmware\u00a0;<\/li>\n<li><strong>Chargement du driver noyau\u00a0:<\/strong> le pilote est d\u00e9sormais chiffr\u00e9 en RC4 et directement int\u00e9gr\u00e9 au binaire principal sous forme d'overlay, contrairement aux versions pr\u00e9c\u00e9dentes o\u00f9 il \u00e9tait fourni s\u00e9par\u00e9ment par l'installateur\u00a0;<\/li>\n<li><strong>Modification du code interne\u00a0:<\/strong> plusieurs \u00e9l\u00e9ments du code ont \u00e9t\u00e9 renomm\u00e9s, ce qui sugg\u00e8re une r\u00e9organisation ou une reconstruction partielle du code source.<\/li>\n<\/ul>\n<h2>Nouveaux variants en 2026<\/h2>\n<h3>Description<\/h3>\n<p>L'analyse de trois \u00e9chantillons montre que M\u00e9lof\u00e9e a \u00e9volu\u00e9 depuis les versions pr\u00e9c\u00e9demment observ\u00e9es. Si les m\u00e9canismes de communication r\u00e9seau et le chiffrement RC4 restent similaires, plusieurs changements ont \u00e9t\u00e9 identifi\u00e9s, notamment l\u2019ajout de nouvelles capacit\u00e9s, la modularisation de certaines fonctionnalit\u00e9s sous forme de librairie dynamique et des modifications internes de l\u2019implant. Ces \u00e9volutions sont d\u00e9taill\u00e9es dans les sections suivantes.<\/p>\n<p>L'implant contient un module principal, capable d'ex\u00e9cuter quelques commandes de base. Il est \u00e9galement capable de supporter des fonctionnalit\u00e9s aditionnelles via le t\u00e9l\u00e9chargement de modules compl\u00e9mentaires depuis le C2.<\/p>\n<p>Le tableau ci\u2011dessous r\u00e9capitule l\u2019ensemble des commandes support\u00e9es\u00a0:<\/p>\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_0\"\n     id='ninja_table_builder_845084'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_0\"\n     style=\"\n     max-height:2000px;\n     max-width: 700px;margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845084 ntb_845084\" style=\"margin-top: 0px; margin-bottom: 0px; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px; margin-right: auto;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_4183003\" id=\"tr_id_4183003\" data-draggable=\"true\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_13319522\" class=\"td_class_13319522 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13319522\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_0\" spellcheck=\"false\"><strong>ID<\/strong><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_89975694\" class=\"td_class_89975694 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_89975694\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_2\" spellcheck=\"false\"><strong>Description<\/strong><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_71079594\" class=\"td_class_71079594 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71079594\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_3\" spellcheck=\"false\"><strong>Remarques<\/strong><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7014915\" id=\"tr_id_7014915\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_83514147\" class=\"td_class_83514147 table-data\" rowspan=\"1\" colspan=\"3\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_83514147\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_4\" spellcheck=\"false\">Commandes de base de l'implant (Module embarqu\u00e9 0x1000)<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_32135275\" class=\"td_class_32135275 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_32135275\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_5\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_76881907\" class=\"td_class_76881907 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_76881907\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_6\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\"><strong>Implant Basic Commands (Embedded Module 0x1000)<\/strong><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2129372\" id=\"tr_id_2129372\" data-draggable=\"true\"><td id=\"td_id_70513721\" class=\"td_class_70513721 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_70513721\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_7\" spellcheck=\"false\">0x1004<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13550874\" class=\"td_class_13550874 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13550874\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_8\" spellcheck=\"false\">R\u00e9cup\u00e9ration de la configuration C2 active.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53075165\" class=\"td_class_53075165 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53075165\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_9\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4899323\" id=\"tr_id_4899323\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_85553181\" class=\"td_class_85553181 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_85553181\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_10\" spellcheck=\"false\">0x1005<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_84069806\" class=\"td_class_84069806 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_84069806\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_11\" spellcheck=\"false\">Chargement d'une nouvelle configuration C2, <b>mais ne remplace pas la configuration embarqu\u00e9e.<\/b><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_59167289\" class=\"td_class_59167289 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_59167289\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_12\" spellcheck=\"false\">Cette commande prend en param\u00e8tre une structure de donn\u00e9es contenant jusqu'\u00e0 trois configurations C2.<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_8851853\" id=\"tr_id_8851853\" data-draggable=\"true\"><td id=\"td_id_14523555\" class=\"td_class_14523555 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_14523555\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_13\" spellcheck=\"false\">0x1006<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_71503555\" class=\"td_class_71503555 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71503555\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_14\" spellcheck=\"false\">D\u00e9sinstaller l\u2019implant et supprimer tous les fichiers qu\u2019il a cr\u00e9\u00e9s.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_24457617\" class=\"td_class_24457617 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_24457617\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_15\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_8480898\" id=\"tr_id_8480898\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_95928320\" class=\"td_class_95928320 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_95928320\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_16\" spellcheck=\"false\">0x1007<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_94092268\" class=\"td_class_94092268 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_94092268\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_17\" spellcheck=\"false\">Proxy TCP.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_75735769\" class=\"td_class_75735769 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_75735769\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_18\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1871675\" id=\"tr_id_1871675\" data-draggable=\"true\"><td id=\"td_id_90175547\" class=\"td_class_90175547 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_90175547\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_19\" spellcheck=\"false\">0x100A<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_14542048\" class=\"td_class_14542048 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_14542048\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_20\" spellcheck=\"false\">Inventaire des modules charg\u00e9s.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_18124918\" class=\"td_class_18124918 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_18124918\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_21\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9357286\" id=\"tr_id_9357286\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_96766214\" class=\"td_class_96766214 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_96766214\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_22\" spellcheck=\"false\">0x100B<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_99197400\" class=\"td_class_99197400 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_99197400\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_23\" spellcheck=\"false\">Commande d\u00e9clar\u00e9e mais non impl\u00e9ment\u00e9e.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_51799313\" class=\"td_class_51799313 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_51799313\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_24\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2549587\" id=\"tr_id_2549587\" data-draggable=\"true\"><td id=\"td_id_61322728\" class=\"td_class_61322728 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_61322728\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_25\" spellcheck=\"false\">0x100C<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_29519682\" class=\"td_class_29519682 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29519682\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_26\" spellcheck=\"false\">D\u00e9chargement d'un module.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_33674158\" class=\"td_class_33674158 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_33674158\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_27\" spellcheck=\"false\">Cette commande prend en param\u00e8tre l'identifiant d'un module (par exemple 0x3000).<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5897656\" id=\"tr_id_5897656\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_69319001\" class=\"td_class_69319001 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_69319001\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_28\" spellcheck=\"false\">0x100D<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22330230\" class=\"td_class_22330230 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22330230\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_29\" spellcheck=\"false\">Forward server.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68310856\" class=\"td_class_68310856 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68310856\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_30\" spellcheck=\"false\">Fonctionalit\u00e9 d\u00e9j\u00e0 existante<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9179045\" id=\"tr_id_9179045\" data-draggable=\"true\" draggable=\"false\"><td id=\"td_id_38984594\" class=\"td_class_38984594 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_38984594\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_31\" spellcheck=\"false\">0x100E<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_80065014\" class=\"td_class_80065014 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_80065014\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_32\" spellcheck=\"false\">Interrompt toutes les connexions et met l\u2019implant en pause pour une dur\u00e9e d\u00e9finie.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_88226858\" class=\"td_class_88226858 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_88226858\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_33\" spellcheck=\"false\">Cette commande accepte un param\u00e8tre num\u00e9rique repr\u00e9sentant la dur\u00e9e en minutes de mise en veille de l'implant.<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9881589\" id=\"tr_id_9881589\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_21662751\" class=\"td_class_21662751 table-data\" rowspan=\"1\" colspan=\"3\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_21662751\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_34\" spellcheck=\"false\">Identifiants utilis\u00e9e en r\u00e9ponse (trait\u00e9s par le C2)<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_51988223\" class=\"td_class_51988223 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_51988223\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_35\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_65451569\" class=\"td_class_65451569 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_65451569\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_36\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5813799\" id=\"tr_id_5813799\" data-draggable=\"true\"><td id=\"td_id_43338807\" class=\"td_class_43338807 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43338807\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_37\" spellcheck=\"false\">0x1001<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_14897165\" class=\"td_class_14897165 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_14897165\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_38\" spellcheck=\"false\">Cette identifiant est utilis\u00e9 dans un paquet contenant les informations relatives \u00e0 la victime, puis attend en retour la valeur <i>magic number<\/i> transmise par le serveur C2 afin de poursuivre la communication.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_54928410\" class=\"td_class_54928410 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_54928410\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_39\" spellcheck=\"false\">Cet identifiant est g\u00e9n\u00e9r\u00e9 de mani\u00e8re transparente par l'implant \u00e0 chaque connexion au C2 pour amorcer le dialogue. L'attaquant n'a jamais \u00e0 solliciter cette commande.<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2003091\" id=\"tr_id_2003091\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_74802544\" class=\"td_class_74802544 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_74802544\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_40\" spellcheck=\"false\">0x1002<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_30949740\" class=\"td_class_30949740 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_30949740\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_41\" spellcheck=\"false\">Identifiant utilis\u00e9 par le module pour demander un t\u00e9l\u00e9chargement de module compl\u00e9mentaire au C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_92370553\" class=\"td_class_92370553 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_92370553\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_42\" spellcheck=\"false\">Cet identifiant est renvoy\u00e9 apr\u00e8s une demande de l'op\u00e9rateur<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7176379\" id=\"tr_id_7176379\" data-draggable=\"true\" draggable=\"false\"><td id=\"td_id_46562666\" class=\"td_class_46562666 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_46562666\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_43\" spellcheck=\"false\">0x1003<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_51817168\" class=\"td_class_51817168 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_51817168\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_44\" spellcheck=\"false\">Signalement de pr\u00e9sence (<em>heartbeat<\/em>)<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_65020537\" class=\"td_class_65020537 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_65020537\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_45\" spellcheck=\"false\">L'implant envoie \u00e9galement l'identifiant unique bas\u00e9 sur le condensat JSHash des informations syst\u00e8me.<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_6790441\" id=\"tr_id_6790441\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_71347476\" class=\"td_class_71347476 table-data\" rowspan=\"1\" colspan=\"3\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71347476\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_46\" spellcheck=\"false\">Commande du module Shell (0x2000)<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_74467514\" class=\"td_class_74467514 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_74467514\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_47\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Shell Module Commands (0x2000)<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_25516212\" class=\"td_class_25516212 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_25516212\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_48\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9351167\" id=\"tr_id_9351167\" data-draggable=\"true\"><td id=\"td_id_28075464\" class=\"td_class_28075464 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_28075464\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_49\" spellcheck=\"false\">0x2001<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_52997521\" class=\"td_class_52997521 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_52997521\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_50\" spellcheck=\"false\">Interactive shell interface.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_31680624\" class=\"td_class_31680624 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_31680624\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_51\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_6235994\" id=\"tr_id_6235994\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_49462518\" class=\"td_class_49462518 table-data\" rowspan=\"1\" colspan=\"3\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_49462518\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_52\" spellcheck=\"false\">Commandes du module pour la gestion des fichiers et r\u00e9pertoires (0x3000)<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_24733760\" class=\"td_class_24733760 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_24733760\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_53\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_73271968\" class=\"td_class_73271968 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_73271968\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_54\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Module Commands for the Files and Directories Management (0x3000)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9401689\" id=\"tr_id_9401689\" data-draggable=\"true\"><td id=\"td_id_23991900\" class=\"td_class_23991900 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_23991900\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_55\" spellcheck=\"false\">0x3002<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_78966764\" class=\"td_class_78966764 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78966764\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_56\" spellcheck=\"false\">Lister le contenu d'un dossier.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_47144657\" class=\"td_class_47144657 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_47144657\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_57\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4409289\" id=\"tr_id_4409289\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_65768491\" class=\"td_class_65768491 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_65768491\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_58\" spellcheck=\"false\">0x3003<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_41310130\" class=\"td_class_41310130 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_41310130\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_59\" spellcheck=\"false\">Supprimer un fichier ou un dossier.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_77785125\" class=\"td_class_77785125 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77785125\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_60\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3931863\" id=\"tr_id_3931863\" data-draggable=\"true\"><td id=\"td_id_69441037\" class=\"td_class_69441037 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_69441037\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_61\" spellcheck=\"false\">0x3004<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_72779751\" class=\"td_class_72779751 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_72779751\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_62\" spellcheck=\"false\">Cr\u00e9er un nouveau dossier.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_96121487\" class=\"td_class_96121487 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_96121487\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_63\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9925167\" id=\"tr_id_9925167\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_20267676\" class=\"td_class_20267676 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_20267676\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_64\" spellcheck=\"false\">0x3005<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_80783468\" class=\"td_class_80783468 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_80783468\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_65\" spellcheck=\"false\">Modifier les dates de cr\u00e9ation, d'acc\u00e8s et de modification des fichiers o\u00f9 des r\u00e9pertoires.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_85986706\" class=\"td_class_85986706 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_85986706\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_66\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4769491\" id=\"tr_id_4769491\" data-draggable=\"true\"><td id=\"td_id_40441057\" class=\"td_class_40441057 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_40441057\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_67\" spellcheck=\"false\">0x3006<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_43742620\" class=\"td_class_43742620 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43742620\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_68\" spellcheck=\"false\">Lancer le t\u00e9l\u00e9chargement d'un fichier depuis le serveur de l'attaquant vers la machine de la victime.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_38710942\" class=\"td_class_38710942 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_38710942\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_69\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7081113\" id=\"tr_id_7081113\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_99007640\" class=\"td_class_99007640 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_99007640\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_70\" spellcheck=\"false\">0x3007<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_75809512\" class=\"td_class_75809512 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_75809512\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_71\" spellcheck=\"false\">Lancer l'exfiltration d'un fichier depuis la machine de la victime vers le serveur de l'attaquant.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_72752213\" class=\"td_class_72752213 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_72752213\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_72\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_8286542\" id=\"tr_id_8286542\" data-draggable=\"true\"><td id=\"td_id_39949667\" class=\"td_class_39949667 table-data\" rowspan=\"1\" colspan=\"3\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_39949667\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_73\" spellcheck=\"false\">Commande du module pour l'ex\u00e9cution de commande \u00e0 distance (0x4000)<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53659590\" class=\"td_class_53659590 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53659590\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_74\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15109157\" class=\"td_class_15109157 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15109157\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_75\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Module Command for Remote Collection (0x4000)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5033182\" id=\"tr_id_5033182\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_10420575\" class=\"td_class_10420575 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10420575\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_76\" spellcheck=\"false\">0x4001<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_77526115\" class=\"td_class_77526115 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77526115\"><div class=\"single-item item-active other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_77\" spellcheck=\"false\">Ex\u00e9cution de commande \u00e0 distance.<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53162044\" class=\"td_class_53162044 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53162044\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" id=\"mce_78\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<h3>Fonctionnement global<\/h3>\n<h4>Phase d'initialisation de l'implant<\/h4>\n<p>L'implant prend plusieurs arguments en ligne de commande\u00a0:<\/p>\n<ul>\n<li><code>\/t:<\/code> assure une persistance via la <code>crontab<\/code>\u00a0;<\/li>\n<li><code>\/s:<\/code> assure une persistance du malware via un service <code>systemd<\/code>\u00a0;<\/li>\n<li><code>\/r:<\/code> lance le binaire en mode d\u00e9mon via un appel \u00e0 <code>daemon<\/code>\u00a0;<\/li>\n<li><code>\/u:<\/code> d\u00e9sinstalle l'implant et les fichiers de persistance associ\u00e9s\u00a0;<\/li>\n<li><code>hide:<\/code> active la fonction de camouflage du rootkit\u00a0;<\/li>\n<li><code>show:<\/code> d\u00e9sactive la fonction de camouflage du rootkit.<\/li>\n<\/ul>\n<p>Lors de son ex\u00e9cution, l'implant effectue des actions pr\u00e9paratoires afin d'\u00e9tablir son environnement d'ex\u00e9cution afin de\u00a0:<\/p>\n<ul>\n<li><strong>Auto-r\u00e9f\u00e9rencement\u00a0:<\/strong> l'implant lit le fichier <code>\/proc\/self\/exe<\/code> afin de r\u00e9cup\u00e9rer son propre chemin d'ex\u00e9cution sur le syst\u00e8me ;<\/li>\n<li><strong>Verrou d'instance unique\u00a0:<\/strong> l'implant met en place un mutex non bloquant via l'appel <code>flock()<\/code> sur un fichier d\u00e9di\u00e9 (<code>\/tmp\/lock_ax<\/code> dans les \u00e9chantillons analys\u00e9s). Ce m\u00e9canisme emp\u00eache plusieurs instances de fonctionner simultan\u00e9ment sur une m\u00eame machine\u00a0;<\/li>\n<li><strong>V\u00e9rification de compatibilit\u00e9 du noyau\u00a0:<\/strong> avant de charger le rootkit, l'implant v\u00e9rifie l'environnement d'ex\u00e9cution de la machine compromise. Il r\u00e9cup\u00e8re la version du noyau Linux via l'appel <code>uname()<\/code>, puis s'assure qu'il est compatible avec le rootkit. Si ce n'est pas le cas, l'implant abandonne le chargement du rootkit et poursuit son ex\u00e9cution dans le cas contraire. Le rootkit fournit les capacit\u00e9s de dissimulation utilis\u00e9es par l'implant. La communication entre le processus utilisateur et le module noyau repose sur une interface <code>ioctl()<\/code> utilisant le code de requ\u00eate <code>0xE0E0E0E<\/code>.<\/li>\n<\/ul>\n<p>Le fonctionnement de ce rootkit ne sera pas d\u00e9taill\u00e9 dans cette analyse, celui-ci ayant d\u00e9j\u00e0 \u00e9t\u00e9 document\u00e9 par XLab Qianxin [<a href=\"https:\/\/blog.xlab.qianxin.com\/analysis_of_new_melofee_variant_en\/\" target=\"_blank\" rel=\"noopener\">4<\/a>].<\/p>\n<h4>Phase de collecte d'informations syst\u00e8me<\/h4>\n<p>Avant tout contact avec le serveur C2, l'implant collecte plusieurs informations sur la machine compromise afin de constituer une fiche d'identification de l'h\u00f4te. Cette collecte permet \u00e0 l'op\u00e9rateur de disposer d'un contexte sur la machine infect\u00e9e avant l'ex\u00e9cution des fonctionnalit\u00e9s op\u00e9rationnelles de l'implant.<\/p>\n<p>L'implant g\u00e9n\u00e8re tout d'abord un identifiant unique de machine via l'algorithme <code>JSHash<\/code> (Justin Sobel [<a href=\"https:\/\/www.partow.net\/programming\/hashfunctions\/#JSHashFunction\" target=\"_blank\" rel=\"noopener\">13<\/a>]).[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code>uint <span style=\"color: #333399;\">Calculate_JSHash<\/span>(<span style=\"color: #0000ff;\"><strong>char<\/strong><\/span> *param_1, uint param_2)<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>uint local_c = <span style=\"color: #0000ff;\">0x4e67c6a7<\/span>;<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code><strong><span style=\"color: #0000ff;\">for<\/span><\/strong> (uint i = <span style=\"color: #0000ff;\">0<\/span>; i &lt; param_2; i++) { <\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>local_c = local_c ^ (local_c &gt;&gt; 2) + local_c * <span style=\"color: #0000ff;\">0x20<\/span> + (<strong><span style=\"color: #0000ff;\">int<\/span><\/strong>)param_1[i];<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>}<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code><strong><span style=\"color: #0000ff;\">return<\/span><\/strong> local_c;<\/code><\/p>\n<p><code>}<\/code>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Cette impl\u00e9mentation utilise la constante d'initialisation <code>0x4E67C6A7<\/code>. La valeur hach\u00e9e est calcul\u00e9e \u00e0 partir de plusieurs attributs syst\u00e8me r\u00e9cup\u00e9r\u00e9s par l'implant\u00a0:<\/p>\n<ul>\n<li>la plateforme cible, dans notre cas \"Linux\"\u00a0;<\/li>\n<li>la distribution Linux\u00a0;<\/li>\n<li>l'utilisateur courant\u00a0;<\/li>\n<li>le nom d'h\u00f4te de la machine.<\/li>\n<\/ul>\n<p>En compl\u00e9ment de cet identifiant, l'implant collecte les informations suivantes\u00a0:<\/p>\n<ul>\n<li><strong>Nom d'h\u00f4te :<\/strong> r\u00e9cup\u00e9ration du nom de la machine\u00a0;<\/li>\n<li><strong>Utilisateur courant :<\/strong> r\u00e9cup\u00e9ration du compte associ\u00e9 \u00e0 la session active\u00a0;<\/li>\n<li><strong>Distribution Linux :<\/strong> identification du syst\u00e8me d'exploitation (via la lecture du fichier <code>\/etc\/issue<\/code> ou <code>\/etc\/redhat-release<\/code>)\u00a0;<\/li>\n<li><strong>Adresses IPv4 locales :<\/strong> interrogation des interfaces r\u00e9seau (via un appel \u00e0 la fonction <code>getifaddrs<\/code>)\u00a0;<\/li>\n<li><strong>Plateforme cible :<\/strong> Valeur fixe indiquant l'environnement (<code>linux<\/code>)\u00a0;<\/li>\n<li><strong>Horodatage :<\/strong> r\u00e9cup\u00e9ration de la date et de l'heure syst\u00e8me via un appel \u00e0 <code>localtime<\/code> (et un formatage au format <code>%m-%d-%Y %H:%M:%S<\/code>).<\/li>\n<\/ul>\n<p>L'ensemble des informations collect\u00e9es est ensuite concat\u00e9n\u00e9 dans une cha\u00eene texte s\u00e9par\u00e9e par des tabulations\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code><span style=\"color: #333399;\">&lt;Machine_ID_JSHASH&gt;<\/span>\\t<span style=\"color: #333399;\">&lt;Hostname&gt;<\/span>\\t<span style=\"color: #333399;\">&lt;Username&gt;<\/span>\\t<span style=\"color: #333399;\">&lt;Distribution&gt;<\/span>\\t<span style=\"color: #333399;\">&lt;Local_IPs&gt;<\/span>\\t<span style=\"color: #333399;\">&lt;Platform&gt;<\/span>\\t<span style=\"color: #333399;\">&lt;Timestamp&gt;<\/span><\/code>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Cette fiche d\u2019identification est envoy\u00e9e au serveur C2 \u00e0 chaque connexion. L\u2019implant ne se contente pas de l\u2019envoyer au premier contact. Il refait automatiquement cette collecte et renvoie la fiche apr\u00e8s\u00a0:<\/p>\n<ul>\n<li>Lors d'une reconnexion apr\u00e8s coupure\u00a0;<\/li>\n<li>En sortie de p\u00e9riode de veille\u00a0;<\/li>\n<li>Suite \u00e0 un red\u00e9marrage de l'implant.<\/li>\n<\/ul>\n<h4>Protocoles de communication<\/h4>\n<p>Afin d'assurer sa liaison, l'implant int\u00e8gre une configuration de secours comprenant jusqu'\u00e0 trois serveurs C2 (d\u00e9finis par un h\u00f4te, un port et un type de protocole). Il tente de se connecter \u00e0 chacun d'eux successivement <strong>jusqu'\u00e0 ce qu'une connexion aboutisse, ce qui fige le canal actif et stoppe les autres tentatives.<\/strong> L'analyse du code a mis en \u00e9vidence plusieurs m\u00e9canismes de communication distincts pour ces entr\u00e9es.<\/p>\n<p>Le tableau suivant pr\u00e9sente les caract\u00e9ristiques de chaque type identifi\u00e9\u00a0:<\/p>\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_1\"\n     id='ninja_table_builder_845085'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_1\"\n     style=\"\n     max-height:1000px;\n     max-width: 700px;margin-left: auto; margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845085 ntb_845085\" style=\"margin: 0px auto; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_9112187\" id=\"tr_id_9112187\" data-draggable=\"true\" draggable=\"false\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_30793859\" class=\"td_class_30793859 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_30793859\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_0\" spellcheck=\"false\"><strong>Type<\/strong><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_49767417\" class=\"td_class_49767417 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_49767417\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_2\" spellcheck=\"false\"><strong>Nom<\/strong><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16744151\" class=\"td_class_16744151 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16744151\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_3\" spellcheck=\"false\"><strong>Description<\/strong><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4887839\" id=\"tr_id_4887839\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_27313596\" class=\"td_class_27313596 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27313596\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_4\" spellcheck=\"false\">1 \/ 5<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68240271\" class=\"td_class_68240271 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68240271\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_5\" spellcheck=\"false\">TcpConn<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27703185\" class=\"td_class_27703185 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27703185\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_6\" spellcheck=\"false\">Mode TCP classique. L'implant r\u00e9sout l'adresse du serveur via getaddrinfo(), cr\u00e9e un socket IPv4 TCP puis \u00e9tablit la connexion avec connect(). Aucun \u00e9change pr\u00e9alable suppl\u00e9mentaire n'est r\u00e9alis\u00e9.<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2783646\" id=\"tr_id_2783646\" data-draggable=\"true\"><td id=\"td_id_29648964\" class=\"td_class_29648964 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29648964\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_7\" spellcheck=\"false\">2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_55491414\" class=\"td_class_55491414 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_55491414\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_8\" spellcheck=\"false\">HttpConn<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16643343\" class=\"td_class_16643343 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16643343\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_9\" spellcheck=\"false\">Mode TCP avec une poign\u00e9e de main applicative au format HTTP minimal. Apr\u00e8s l'\u00e9tablissement de la connexion TCP, l'implant envoie POST \/ HTTP\/1.1rn et attend la r\u00e9ponse HTTP\/1.1 200 OKrn avant d'initialiser la session.<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4498477\" id=\"tr_id_4498477\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_76480319\" class=\"td_class_76480319 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_76480319\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_10\" spellcheck=\"false\">3<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_48698001\" class=\"td_class_48698001 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48698001\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_11\" spellcheck=\"false\">HttpsConn<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_43934236\" class=\"td_class_43934236 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43934236\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_12\" spellcheck=\"false\">Mode reposant sur une connexion TLS suivie d'une Handshake HTTP minimale similaire \u00e0 celle du type 2, utilis\u00e9e pour valider le canal de communication avant l'initialisation de la session C2.<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1894652\" id=\"tr_id_1894652\" data-draggable=\"true\"><td id=\"td_id_95538208\" class=\"td_class_95538208 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_95538208\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_13\" spellcheck=\"false\">4<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16932807\" class=\"td_class_16932807 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16932807\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_14\" spellcheck=\"false\">TlsConn<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_20105104\" class=\"td_class_20105104 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_20105104\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_15\" spellcheck=\"false\"><span style=\"color: rgb(23, 43, 77); font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Ubuntu, system-ui, &quot;Helvetica Neue&quot;, sans-serif; font-size: 14px;\">Mode \u00e9tablissant une connexion TCP <\/span><span class=\"inline-comment-marker\" data-ref=\"e269246d-7da2-4153-a3c4-b0391a2bb72e\" style=\"color: rgb(23, 43, 77); font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Ubuntu, system-ui, &quot;Helvetica Neue&quot;, sans-serif; font-size: 14px;\">encapsul\u00e9e dans TLS<\/span><span style=\"color: rgb(23, 43, 77); font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Ubuntu, system-ui, &quot;Helvetica Neue&quot;, sans-serif; font-size: 14px;\">. Les captures r\u00e9seau r\u00e9alis\u00e9es en environnement contr\u00f4l\u00e9 confirment l'utilisation de TLS 1.2.<\/span><\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<h5>Format du protocole applicatif<\/h5>\n<p>Chaque message applicatif suit une structure \u00e0 deux parties\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<\/p>\n<pre><code>\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\r\n\u2502 HEADER (<span style=\"color: #0000ff;\">16<\/span> octets, clair) \u2502 PAYLOAD (<span style=\"color: #333399;\">N<\/span> octets, RC4) |\r\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\r\n<\/code><\/pre>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]L'en-t\u00eate, transmis en clair, poss\u00e8de la structure suivante\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code>struct <span style=\"color: #333399;\">PacketHeader<\/span> {<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>uint32_t type; <em>\/\/ Command Opcode<\/em><\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>uint32_t length; <em>\/\/ Payload Size<\/em><\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>uint32_t param1; <em>\/\/ Usage varying with command type<\/em><\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>uint32_t param2; <em>\/\/ Usage varying with command type<\/em><\/code><\/p>\n<p><code>};<\/code>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Les deux derniers champs servent d'op\u00e9randes pour certaines instructions. \u00c0 titre d'exemple, lors d'une demande de t\u00e9l\u00e9chargement, le quatri\u00e8me champ v\u00e9hicule l'identifiant du module requis.<\/p>\n<p>La charge utile (<em>payload<\/em>) optionnelle est, quand elle est pr\u00e9sente, chiffr\u00e9e en <strong>RC4<\/strong> au moyen d'une cl\u00e9 statique embarqu\u00e9e dans les implants (<code>Trbv5245GTF<\/code> dans les \u00e9chantillons analys\u00e9s).<\/p>\n<h6>Exemple 1 : Demande de t\u00e9l\u00e9chargement de module (0x1002)<\/h6>\n<p>Le paquet r\u00e9seau prend la forme suivante\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<\/p>\n<pre><code><span style=\"color: #0000ff;\">00 00 10 02  00 00 00 00  00 00 00 02  00 00 30 00<\/span>\r\n\u2514\u2500\u2500\u2500type\u2500\u2500\u2500\u2518\u2514\u2500\u2500\u2500length\u2500\u2518 \u2514\u2500\u2500\u2500param1\u2500\u2518  \u2514\u2500\u2500\u2500param2\u2500\u2518\r\n   <span style=\"color: #0000ff;\">0x1002<\/span>         <span style=\"color: #0000ff;\">0<\/span>            <span style=\"color: #0000ff;\">2<\/span>           <span style=\"color: #0000ff;\">0x3000<\/span><\/code><\/pre>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Lors de cette demande, les param\u00e8tres de la structure sont d\u00e9finis ainsi :<\/p>\n<ul>\n<li><strong>Type :<\/strong> 0x1002 (identifiant de r\u00e9ponse utilis\u00e9 par l'implant)\u00a0;<\/li>\n<li><strong>Taille du payload :<\/strong> 0 (aucun contenu additionnel dans le payload)\u00a0;<\/li>\n<li><strong>Param\u00e8tre 1 :<\/strong> 2 (code fixe de sous-commande)\u00a0;<\/li>\n<li><strong>Param\u00e8tre 2 :<\/strong> Identifiant du module demand\u00e9 (ici, 0x3000 pour la gestion de fichiers)\u00a0;<\/li>\n<li><strong>Payload :<\/strong> Vide<\/li>\n<\/ul>\n<h6>Exemple 2 : Suppression de fichier (0x3003)<\/h6>\n<p>Le paquet r\u00e9seau prend la forme suivante\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<\/p>\n<pre><code><span style=\"color: #0000ff;\">00 00 30 03  00 00 00 0d  00 00 00 00  00 00 00 00<\/span>\r\n\u2514\u2500\u2500type\u2500\u2500\u2518   \u2514\u2500length\u2500\u2518   \u2514\u2500param1\u2500\u2518   \u2514\u2500param2\u2500\u2518\r\n <span style=\"color: #0000ff;\">0x3003<\/span>      <span style=\"color: #0000ff;\">13<\/span> octets       <span style=\"color: #0000ff;\">0<\/span>           <span style=\"color: #0000ff;\">0<\/span>\r\n(<span style=\"color: #333399;\">DelFile<\/span>)\r\n<span style=\"color: #333399;\">Payload<\/span> (<span style=\"color: #0000ff;\">13<\/span> octets, RC4(`\/tmp\/test.txt`))\r\nHexdump:\r\n<span style=\"color: #0000ff;\">00000000<\/span>  <span style=\"color: #0000ff;\">00 00 30 03 00 00 00 0d<\/span>  <span style=\"color: #0000ff;\">00 00 00 00 00 00 00 00<\/span>  |..<span style=\"color: #0000ff;\">0<\/span>.............|\r\n<span style=\"color: #0000ff;\">00000010<\/span>  <span style=\"color: #0000ff;\">2f 74 6d 70 2f 74 65 73<\/span>  <span style=\"color: #0000ff;\">74 2e 74 78 74<\/span>           |\/tmp\/test.txt   |<\/code><\/pre>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Une fois le module charg\u00e9e en m\u00e9moire, l'appel de ses fonctionnalit\u00e9s internes s'effectue selon une structure de donn\u00e9es sp\u00e9cifique. Dans ce cas pr\u00e9cis, les champs param\u00e8tre 1 et param\u00e8tre 2 restent \u00e0 z\u00e9ro, car la donn\u00e9e utile est enti\u00e8rement d\u00e9port\u00e9e dans le payload. Ce dernier contient le chemin du fichier \u00e0 cibler (par exemple \/tmp\/test.txt), chiffr\u00e9 en RC4.<\/p>\n<h6>Exemple 3 : Le paquet d'enregistrement<\/h6>\n<p>Le paquet r\u00e9seau prend la forme suivante\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<\/p>\n<pre><code><span style=\"color: #333399;\">Header<\/span> (<span style=\"color: #0000ff;\">16<\/span> bytes, clear):\r\n<span style=\"color: #0000ff;\">00 00 10 01 00 00 00 8e 00 00 00 00 00 00 00 00<\/span>\r\n\u2514\u2500\u2500type\u2500\u2500\u2518  \u2514\u2500length\u2500\u2500\u2518 \u2514\u2500param1\u2500\u2518  \u2514\u2500param2\u2500\u2500\u2518\r\n <span style=\"color: #0000ff;\">0x1001<\/span>      142(<span style=\"color: #0000ff;\">0x8e<\/span>)       <span style=\"color: #0000ff;\">0<\/span>           <span style=\"color: #0000ff;\">0<\/span>\r\n<span style=\"color: #333399;\">Payload<\/span> (<span style=\"color: #0000ff;\">142<\/span> bytes, <span style=\"color: #333399;\">RC4<\/span> encryption), once decrypted :\r\n<span style=\"color: #0000ff;\">1496026344<\/span>\tlocalhost.localdomain\troot\t<span style=\"color: #333399;\">Red Hat Enterprise Linux Server<\/span> release <span style=\"color: #0000ff;\">7.9<\/span> (<span style=\"color: #333399;\">Maipo<\/span>)\t<span style=\"color: #0000ff;\">127.0.0.1 192.168.100.128<\/span> \tlinux\t<span style=\"color: #0000ff;\">08<\/span>-<span style=\"color: #0000ff;\">02<\/span>-<span style=\"color: #0000ff;\">2026<\/span> <span style=\"color: #0000ff;\">10<\/span>:<span style=\"color: #0000ff;\">53<\/span>:<span style=\"color: #0000ff;\">21<\/span>\r\n<span style=\"color: #333399;\">Hexdump<\/span>:\r\n<span style=\"color: #0000ff;\">00000000  00 00 10 01 00 00 00 8e  00 00 00 00 00 00 00 00<\/span>  |................|\r\n<span style=\"color: #0000ff;\">00000010  31 34 39 36 30 32 36 33  34 34 09 6c 6f 63 61 6<\/span>c  |<span style=\"color: #0000ff;\">1496026344.l<\/span>ocal|\r\n<span style=\"color: #0000ff;\">00000020  68 6f 73 74 2<\/span>e <span style=\"color: #0000ff;\">6<\/span>c <span style=\"color: #0000ff;\">6f 63<\/span>  <span style=\"color: #0000ff;\">61 6<\/span>c <span style=\"color: #0000ff;\">64 6f 6d 61 69 6<\/span>e  |host.localdomain|\r\n<span style=\"color: #0000ff;\">00000030  09 72 6f 6f 74 09 52 65  64 20 48 61 74 20 45 6<\/span>e  |.root.Red <span style=\"color: #333399;\">Hat En<\/span>|\r\n<span style=\"color: #0000ff;\">00000040  74 65 72 70 72 69 73 65  20 4<\/span>c<span style=\"color: #0000ff;\"> 69 6<\/span>e<span style=\"color: #0000ff;\"> 75 78 20 53<\/span>  |terprise <span style=\"color: #333399;\">Linux S<\/span>|\r\n<span style=\"color: #0000ff;\">00000050  65 72 76 65 72 20 72 65  6c 65 61 73 65 20 37 2<\/span>e  |erver release <span style=\"color: #0000ff;\">7.<\/span>|\r\n<span style=\"color: #0000ff;\">00000060  39 20 28 4d 61 69 70 6f 29  09 31 32 37 2<\/span>e<span style=\"color: #0000ff;\"> 30 2<\/span>e  |<span style=\"color: #0000ff;\">9<\/span> (<span style=\"color: #333399;\">Maipo<\/span>)<span style=\"color: #0000ff;\">.127.0.<\/span>|\r\n<span style=\"color: #0000ff;\">00000070  30 2<\/span>e<span style=\"color: #0000ff;\"> 31 20 31 39 32 2<\/span>e<span style=\"color: #0000ff;\"> 31  36 38 2<\/span>e<span style=\"color: #0000ff;\"> 31 30 30 2<\/span>e  |<span style=\"color: #0000ff;\">0.1 192.168.100.<\/span>|\r\n<span style=\"color: #0000ff;\">00000080  31 32 38 20 09 6<\/span>c<span style=\"color: #0000ff;\"> 69 6<\/span>e<span style=\"color: #0000ff;\"> 75  78 09 30 38 2d 30 32<\/span>  |<span style=\"color: #0000ff;\">128<\/span> .linux.<span style=\"color: #0000ff;\">08-02<\/span>|\r\n<span style=\"color: #0000ff;\">00000090  2d 32 30 32 36 20 31 30 3<\/span>a<span style=\"color: #0000ff;\">  35 33 3<\/span>a<span style=\"color: #0000ff;\"> 32 31<\/span>        |<span style=\"color: #0000ff;\">2026 10:53:21<\/span>   |<\/code><\/pre>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Ce message permet \u00e0 l'implant de remonter les caract\u00e9ristiques de chaque h\u00f4te compromis ainsi que son identifiant unique.<\/p>\n<h4>Authentification des liaisons aupr\u00e8s du serveur C2<\/h4>\n<p>L'implant valide sa communication avec le serveur C2 en une ou deux \u00e9tapes selon le mode de communication s\u00e9lectionn\u00e9. Ces contr\u00f4les sont strictement bloquants\u00a0: si une validation \u00e9choue, l'implant reste inactif et n'entre jamais dans sa boucle d'ex\u00e9cution de commandes.<\/p>\n<h5>Phase de pr\u00e9-connexion HTTP (Sp\u00e9cifique au modes HttpConn et HttpsConn)<\/h5>\n<p>Cet \u00e9change applicatif constitue le tout premier contact r\u00e9seau sous le protocole HTTP. L'implant commence par envoyer une cha\u00eene statique de 17 octets\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<\/p>\n<pre><code><span style=\"color: #0000ff;\">50 4f 53 54 20 2f 20 48 54 54 50 2f 31 2<\/span>e<span style=\"color: #0000ff;\"> 31 0d 0<\/span>a\r\nPOST \/ HTTP\/<span style=\"color: #0000ff;\">1.1<\/span>\\r\\n   (<span style=\"color: #0000ff;\">17<\/span> bytes)\r\n<span style=\"color: #333399;\">Hexdump<\/span>:\r\n<span style=\"color: #0000ff;\">00000000 50 4f 53 54 20 2f 20 48 54 54 50 2f 31 2<\/span>e<span style=\"color: #0000ff;\"> 31 0d<\/span> |POST \/ HTTP\/<span style=\"color: #0000ff;\">1.1.<\/span>|\r\n<span style=\"color: #0000ff;\">00000010 0<\/span>a |.|<\/code><\/pre>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Le serveur C2 doit obligatoirement r\u00e9pondre par exactement 17\u00a0octets contenant la cha\u00eene\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<\/p>\n<pre><code><span style=\"color: #0000ff;\">48 54 54 50 2f 31 2<\/span>e<span style=\"color: #0000ff;\"> 31 20 32 30 30 20 4f 4<\/span>b<span style=\"color: #0000ff;\"> 0d 0<\/span>a\r\nHTTP\/<span style=\"color: #0000ff;\">1.1 200<\/span> OK\\r\\n   (exactly <span style=\"color: #0000ff;\">17<\/span> bytes)\r\nHexdump:\r\n<span style=\"color: #0000ff;\">00000000  48 54 54 50 2f 31 2<\/span>e<span style=\"color: #0000ff;\"> 31  20 32 30 30 20 4f 4<\/span>b<span style=\"color: #0000ff;\"> 0d<\/span>  |HTTP\/<span style=\"color: #0000ff;\">1.1 200<\/span> OK.|\r\n<span style=\"color: #0000ff;\">00000010  0<\/span>a                                                |.               |<\/code><\/pre>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]La v\u00e9rification dans le binaire est particuli\u00e8rement stricte. L'analyse du code montre que l'implant contr\u00f4le d'abord la taille exacte re\u00e7ue (0x11 en hexad\u00e9cimal, soit 17\u00a0octets), puis effectue une comparaison octet par octet en m\u00e9moire\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code><span style=\"color: #0000ff;\"><strong>if<\/strong><\/span> (bytes_received == <span style=\"color: #0000ff;\">0x11<\/span>) {<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>iVar1 = memcmp(&amp;http_buffer, <span style=\"color: #008000;\">\"HTTP\/1.1 200 OK\\r\\n\"<\/span>, <span style=\"color: #0000ff;\">0x11<\/span>);<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code><strong><span style=\"color: #0000ff;\">if<\/span><\/strong> (iVar1 == <span style=\"color: #0000ff;\">0<\/span>) {<\/code><\/p>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Si la taille re\u00e7ue est diff\u00e9rente, ou si le contenu ne correspond pas exactement, l'implant interrompt la connexion. Ce m\u00e9canisme basique lui permet de s'assurer qu'il dialogue bien avec son infrastructure.<\/p>\n<h5>Authentification de la liaison (commune \u00e0 tous les modes)<\/h5>\n<p>Obligatoire pour l'ensemble des m\u00e9canismes de communication, cet \u00e9change intervient imm\u00e9diatement apr\u00e8s la transmission du paquet d'enregistrement initial (voir l'exemple de structure 0x1001 ci-dessous). Le serveur C2 doit alors r\u00e9pondre <strong>par exactement 4 octets bruts,<\/strong> sans aucun en-t\u00eate ni chiffrement\u00a0:[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code><span style=\"color: #0000ff;\">11 22 33 44<\/span>   (value <span style=\"color: #0000ff;\">0x11223344<\/span> en network <strong><span style=\"color: #0000ff;\">byte<\/span><\/strong> order)<\/code>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Le code correspondant :[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code><span style=\"color: #333399;\">BaseConn<\/span>::recvn(pBVar5, &amp;local_ec, <span style=\"color: #0000ff;\">4<\/span>, <span style=\"color: #0000ff;\">60000<\/span>);   <em>\/\/ Reads exactly 4 bytes, timeout 60s<\/em><\/code><\/p>\n<p><code><strong><span style=\"color: #0000ff;\">if<\/span><\/strong> ((iVar3 == <span style=\"color: #0000ff;\">0<\/span>) &amp;&amp; (my_htonl(local_ec) == <span style=\"color: #0000ff;\">0x11223344<\/span>))<\/code>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]Si les 4 octets re\u00e7us ne correspondent pas strictement \u00e0 cette constante, ou si le d\u00e9lai de 60 secondes est d\u00e9pass\u00e9, la connexion est imm\u00e9diatement rejet\u00e9e par l'implant.<\/p>\n<h4>R\u00e9capitulatif du fonctionnement global<\/h4>\n<p>L'architecture globale demeure inchang\u00e9e par rapport aux versions de 2023 et 2024, mais les implants se distinguent d\u00e9sormais par l'ajout de nouvelles fonctionnalit\u00e9s qui sont d\u00e9taill\u00e9es dans le prochain paragraphe.<\/p>\n<h3>Pr\u00e9sentation des nouvelles fonctionnalit\u00e9s<\/h3>\n<h4>R\u00e9cup\u00e9ration de la configuration r\u00e9seau active<\/h4>\n<p>Cette fonctionnalit\u00e9, identifi\u00e9e par l'ID 0x1004, permet de r\u00e9cup\u00e9rer la configuration r\u00e9seau active de l'implant et de la transmettre au serveur de commande et de contr\u00f4le (C2).<\/p>\n<h4>Chargement d'une nouvelle configuration r\u00e9seau<\/h4>\n<p>Cette fonctionnalit\u00e9, identifi\u00e9e par l'ID 0x1005, permet de charger dynamiquement une nouvelle configuration C2 sans modifier la configuration r\u00e9seau embarqu\u00e9e.<\/p>\n<p>Le diagramme ci-dessous illustre la logique du chargement d'une nouvelle configuration r\u00e9seau au sein de l'implant :<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-845099 size-large\" src=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr-1024x108.png\" alt=\"\" width=\"1024\" height=\"108\" srcset=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr-1024x108.png 1024w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr-300x32.png 300w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr-768x81.png 768w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr-1536x162.png 1536w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr-1396x147.png 1396w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr-700x74.png 700w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image2-vfr.png 1564w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p>L'implant effectue une v\u00e9rification stricte du fichier de configuration qui doit \u00eatre :<\/p>\n<ul>\n<li><strong>Taille \u00e9gale \u00e0 228 octets (0xe4) :<\/strong> l'implant valide le fichier externe et applique la nouvelle configuration.<\/li>\n<li><strong>Taille diff\u00e9rente ou fichier absent :<\/strong> le fichier est jug\u00e9 invalide. L'implant rejette la modification et utilise la configuration embarqu\u00e9e.<\/li>\n<\/ul>\n<h4>Gestion dynamique de modules<\/h4>\n<p>L'implant utilise un syst\u00e8me de module lui permettant de charger dynamiquement des fonctionnalit\u00e9s compl\u00e9mentaires.<\/p>\n<p>Cette modularisation est bas\u00e9e sur les \u00e9l\u00e9ments suivants:<\/p>\n<ul>\n<li>Un identifiant de module calcul\u00e9 dynamiquement par un masque de bits : <code>dwModuleID = dwCommandId &amp; 0xF000<\/code>\u00a0;<\/li>\n<li>Une liste cha\u00een\u00e9e contenant les modules d\u00e9j\u00e0 charg\u00e9s (initialis\u00e9e avec le module central embarqu\u00e9 <code>0x1000<\/code>)\u00a0;<\/li>\n<li>L'exposition par chaque module d'une interface commune (d\u00e9taill\u00e9e ci apr\u00e8s).<\/li>\n<\/ul>\n<p>L'implant supporte 11 modules (en compl\u00e9ment du module central), identifi\u00e9s de <code>0x2000<\/code> \u00e0 <code>0xC000<\/code>.<\/p>\n<p>L'analyse statique des implants a \u00e9galement permis d'identifier plusieurs r\u00e9f\u00e9rences \u00e0 des chemins temporaires utilis\u00e9s lors du m\u00e9canisme de chargement dynamique des modules.<\/p>\n<p>En effet, lors du d\u00e9ploiement d'un module par l'attaquant, celui-ci est stock\u00e9 dans un fichier nomm\u00e9 au format <code>\/tmp\/PLGID<\/code>.<\/p>\n<p>Par ailleurs, deux commandes suppl\u00e9mentaires ont \u00e9t\u00e9 ajout\u00e9es dans l'implant permettant de g\u00e9rer ces plugins\u00a0:<\/p>\n<ul>\n<li>La commande <code>0x100A<\/code>, permettant d'obtenir la liste des modules actifs au sein de l'implant\u00a0;<\/li>\n<li>La commande <code>0x100C<\/code> permettant le d\u00e9chargement d'un module. Elle offre \u00e0 l'op\u00e9rateur la possibilit\u00e9 de retirer un module actif sans n\u00e9cessiter de red\u00e9marrage.<\/li>\n<\/ul>\n<h5>T\u00e9l\u00e9chargement et chargement de module<\/h5>\n<p>Le diagramme ci-dessous retrace les diff\u00e9rentes \u00e9tapes du chargement d'un module par l'implant\u00a0:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-845094 size-large\" src=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr-1024x70.png\" alt=\"\" width=\"1024\" height=\"70\" srcset=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr-1024x70.png 1024w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr-300x21.png 300w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr-768x53.png 768w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr-1536x105.png 1536w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr-1396x96.png 1396w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr-700x48.png 700w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image3-vfr.png 1791w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<h5>Modules connus<\/h5>\n<p>Nos investigations ont permis d'identifier trois modules, associ\u00e9s aux identifiants 0x2000, 0x3000 et 0x4000. Les modules associ\u00e9s aux identifiants 0x5000 \u00e0 0xc000 n'ont pas pu \u00eatre identifi\u00e9s.<\/p>\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_2\"\n     id='ninja_table_builder_845086'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_2\"\n     style=\"\n     max-height:1000px;\n     max-width: 700px;margin-left: auto; margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845086 ntb_845086\" style=\"margin: 0px auto; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_2766520\" id=\"tr_id_2766520\" data-draggable=\"true\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_38066789\" class=\"td_class_38066789 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_38066789\"><div class=\"single-item other-item\" data-draggable=\"true\" draggable=\"false\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_0\" spellcheck=\"false\"><strong>Identifiant<\/strong><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_78570345\" class=\"td_class_78570345 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78570345\"><div class=\"single-item other-item\" data-draggable=\"true\" draggable=\"false\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_2\" spellcheck=\"false\">Nom de fichier<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15666338\" class=\"td_class_15666338 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15666338\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_3\" spellcheck=\"false\">SHA256<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_77742335\" class=\"td_class_77742335 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77742335\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_4\" spellcheck=\"false\">Fonctionnalit\u00e9<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_6909519\" id=\"tr_id_6909519\" data-draggable=\"true\" draggable=\"false\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_81002157\" class=\"td_class_81002157 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_81002157\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_5\" spellcheck=\"false\">0x2000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_94650683\" class=\"td_class_94650683 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_94650683\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_6\" spellcheck=\"false\">\/tmp\/2000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_98611394\" class=\"td_class_98611394 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_98611394\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_7\" spellcheck=\"false\">cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_67554438\" class=\"td_class_67554438 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_67554438\"><div class=\"single-item other-item\" data-draggable=\"true\" draggable=\"false\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_8\" spellcheck=\"false\">Shell interactif<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3868349\" id=\"tr_id_3868349\" data-draggable=\"true\"><td id=\"td_id_71836864\" class=\"td_class_71836864 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71836864\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_9\" spellcheck=\"false\">0x3000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68903576\" class=\"td_class_68903576 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68903576\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_10\" spellcheck=\"false\">\/tmp\/3000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_10099488\" class=\"td_class_10099488 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10099488\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_11\" spellcheck=\"false\">9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_62314177\" class=\"td_class_62314177 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_62314177\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_12\" spellcheck=\"false\">Gestion de fichiers<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7655543\" id=\"tr_id_7655543\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_85598954\" class=\"td_class_85598954 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_85598954\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_13\" spellcheck=\"false\">0x4000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_86010709\" class=\"td_class_86010709 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_86010709\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_14\" spellcheck=\"false\">\/tmp\/4000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_72350250\" class=\"td_class_72350250 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_72350250\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_15\" spellcheck=\"false\">129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_51914659\" class=\"td_class_51914659 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_51914659\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_16\" spellcheck=\"false\">Ex\u00e9cution de commande \u00e0 distance<\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<h5>Interface de plugin (commun \u00e0 tous les modules)<\/h5>\n<p>Les modules analys\u00e9s pr\u00e9sentent une structure commune et exportent tous une fonction nomm\u00e9e xmain servant de point d'entr\u00e9e.<\/p>\n<p>Chaque module impl\u00e9mente une interface identique (<code>GetPlgInterface<\/code>), compos\u00e9e de trois fonctions\u00a0:<\/p>\n<ul>\n<li><code>GetPlugId<\/code> : Cette fonction retourne l'identifiant du module.<\/li>\n<li><code>WritePlugin<\/code> : Cette fonction est appel\u00e9e par l'orchestrateur en lui fournissant la commande demand\u00e9e par l'attaquant ainsi que ses param\u00e8tres \u00e9ventuels.<\/li>\n<li><code>SetBackCall<\/code> : Cette fonction permet \u00e0 l'orchestrateur de fournir un certain nombre de fonctions utilitaires \u00e0 chaque module (telle que l'ex\u00e9cution de shell interactif ou la gestion de tunnels r\u00e9seau).<\/li>\n<\/ul>\n<p>Par ailleurs, l'ensemble des modules analys\u00e9s utilisait les m\u00eames classes pour g\u00e9rer ses communications\u00a0: <code>BaseConn<\/code>, elle m\u00eame utilisant une classe utilitaire <code>SocketApi<\/code> exposant une surcouche des fonctions standard de la libc.<\/p>\n<p>Il est \u00e9galement \u00e0 noter que le module principal de l'implant expose une interface identique.<\/p>\n<h5>Module de shell interactif (CShell)<\/h5>\n<p>Contrairement aux versions de 2023 et 2024 o\u00f9 elle \u00e9tait directement int\u00e9gr\u00e9e, cette capacit\u00e9 d'ex\u00e9cution de commandes \u00e0 distance est d\u00e9sormais externalis\u00e9e sous forme de module.<\/p>\n<p>Son fonctionnement repose sur la cr\u00e9ation d'un pseudo-terminal (PTY) pour offrir un shell classique. Le module y redirige les flux d'entr\u00e9e, de sortie standard et d'erreur, puis tente de lancer l'interpr\u00e9teur <code>\/bin\/bash<\/code> (avec un repli automatique vers <code>\/bin\/sh<\/code> en cas d'\u00e9chec). Avant le lancement du shell, l'environnement d'ex\u00e9cution est configur\u00e9 notamment via les variables <code>TERM<\/code> et <code>HISTFILE<\/code> afin de contr\u00f4ler l'affichage et de d\u00e9sactiver l'enregistrement de l'historique des commandes.<\/p>\n<h5>Module de gestion des fichiers et r\u00e9pertoires (CFile)<\/h5>\n<p>Auparavant int\u00e9gr\u00e9es directement au c\u0153ur de l'implant M\u00e9lof\u00e9e (versions 2023-2024), les capacit\u00e9s de manipulation de fichiers sont d\u00e9sormais externalis\u00e9es.<\/p>\n<p>Ce module permet \u00e0 l'op\u00e9rateur de charger dynamiquement les fonctionnalit\u00e9s suivantes :<\/p>\n<ul>\n<li>\u00c9num\u00e9ration des fichiers et r\u00e9pertoires\u00a0;<\/li>\n<li>Suppression de fichiers\u00a0;<\/li>\n<li>Cr\u00e9ation de r\u00e9pertoires\u00a0;<\/li>\n<li>Modification des horodatages des fichiers\u00a0;<\/li>\n<li>Envoi de fichiers vers la machine compromise\u00a0;<\/li>\n<li>T\u00e9l\u00e9chargement de fichiers depuis la machine compromise.<\/li>\n<\/ul>\n<h5>Module d'ex\u00e9cution de commandes \u00e0 distance (CCmd)<\/h5>\n<p>Autrefois impl\u00e9ment\u00e9 dans l'implant principal de M\u00e9lof\u00e9e, cette capacit\u00e9 d'ex\u00e9cution a \u00e9t\u00e9 externalis\u00e9e dans un module. Le composant re\u00e7oit une commande, l'ex\u00e9cute localement sur l'h\u00f4te via un appel au binaire <code>\/bin\/sh<\/code>, puis r\u00e9cup\u00e8re sa sortie standard ainsi que sa sortie d\u2019erreur avant de transmettre le r\u00e9sultat au serveur C2.<\/p>\n<p>Contrairement au module de session shell, cette fonctionnalit\u00e9 est strictement limit\u00e9e \u00e0 des lancements de commandes unitaires et n'offre aucun terminal interactif.<\/p>\n<h2>Infrastructure<\/h2>\n<p>Lors de nos investigations, nous avons pu identifier deux clusters d'infrastructure li\u00e9s \u00e0 ces implants, sans toutefois pouvoir identifier d'autres implants communiquant avec cette infrastructure.<\/p>\n<p>L'ensemble des IOCs identifi\u00e9s est disponible dans les annexes de cet article.<\/p>\n<h3>Cluster Symantec<\/h3>\n<p>L'ensemble des adresses IP et des domaines utilis\u00e9s en C2 dans les samples les plus r\u00e9cents exposaient le m\u00eame certificat autosign\u00e9 poss\u00e9dant un champ Issuer usurpant l'identit\u00e9 de Symantec (<code>C=US<\/code>, <code>ST=California<\/code>, <code>L=California<\/code>, <code>O=Symantec Corp<\/code>).<\/p>\n<p>En utilisant l'empreinte SHA1 de ce certificat (<code>dbbcb279a1f1a258832174ce63c295c5080de249<\/code>) comme point de pivot, il a \u00e9t\u00e9 possible d'identifier plusieurs serveurs C2 tr\u00e8s probablement li\u00e9s \u00e0 cette menace.<\/p>\n<p>Il est \u00e0 noter que les TTPs consistant \u00e0 utiliser des certificats se faisant passer pour des produits li\u00e9s \u00e0 l'informatique, ainsi que des noms de domaines contenant update ont d\u00e9j\u00e0 \u00e9t\u00e9 document\u00e9s pour des serveurs li\u00e9s \u00e0 l'outil ShadowPad [<a href=\"https:\/\/hunt.io\/blog\/tracking-shadowpad-infrastructure-via-non-standard-certificates\" target=\"_blank\" rel=\"noopener\">6<\/a>].<\/p>\n<h3>Cluster Xdevops<\/h3>\n<p>Lors de l'analyse de l'\u00e9chantillon <code>4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59<\/code>, nous avons identifi\u00e9 que l'adresse IP r\u00e9solue par son serveur de C2 exposait \u00e9galement un certificat autosign\u00e9 (<code>Issuer: \/C=US\/ST=MI\/L=Southfield\/O=xdevops\/OU=xdevops\/CN=update.miss-soft[.]com<\/code>, <code>SHA-1: b6df18f66cf4364be2946d6b981e69763aafde68<\/code>).<\/p>\n<p>En utilisant ce certificat comme point de pivot, nous avons identifi\u00e9 un deuxi\u00e8me cluster d'activit\u00e9, enregistrant des domaines ressemblants \u00e0 des domaines Amazon.<\/p>\n<h2>Similarit\u00e9s avec des familles de codes malveillants existantes<\/h2>\n<p>Les \u00e9chantillons M\u00e9lof\u00e9e \u00e9tudi\u00e9s lors de notre investigation pr\u00e9sentent de nombreuses similarit\u00e9s avec plusieurs familles d'implants existants, bien que ceux-ci ciblent le syst\u00e8me d'exploitation Windows.<\/p>\n<p>Les familles qui ressortent de cette analyse sont les suivantes :<\/p>\n<ul>\n<li><strong>SparrowDoor \/ CrowDoor,<\/strong> une famille d'implants Windows d\u00e9couverts par ESET en 2025, et li\u00e9 au groupe d'attaquants FamousSparrow [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>]\u00a0;<\/li>\n<li><strong>TernDoor,<\/strong> une famille d'implants possiblement d\u00e9riv\u00e9s de CrowDoor, document\u00e9 par Cisco Talos [<a href=\"https:\/\/blog.talosintelligence.com\/uat-9244\/\" target=\"_blank\" rel=\"noopener\">7<\/a>]\u00a0;<\/li>\n<li><strong>Hemigate:<\/strong> une famille d'implants partag\u00e9e par plusieurs groupes d'attaquants [8]\u00a0; [<a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">8<\/a>]\u00a0;<\/li>\n<li><strong>LibreCoin\/Ratels,<\/strong> une famille d'implants probablement li\u00e9e \u00e0 Hemigate [<a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">8<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf\" target=\"_blank\" rel=\"noopener\">11<\/a>, <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/\" target=\"_blank\" rel=\"noopener\">12<\/a>].<\/li>\n<\/ul>\n<p>En particulier, les similarit\u00e9s suivants ont \u00e9t\u00e9 confirm\u00e9es lors de notre analyse\u00a0:<\/p>\n<ul>\n<li>Utilisation de l'algorithme RC4 avec une cl\u00e9 fixe pour d\u00e9chiffrer la configuration et chiffrer les communications [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>, <a href=\"https:\/\/blog.talosintelligence.com\/uat-9244\/\" target=\"_blank\" rel=\"noopener\">7<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">8<\/a>, <a href=\"https:\/\/blog-en.itochuci.co.jp\/entry\/2023\/10\/06\/173200\" target=\"_blank\" rel=\"noopener\">9<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf\" target=\"_blank\" rel=\"noopener\">11<\/a>, <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/\" target=\"_blank\" rel=\"noopener\">12<\/a>]\u00a0;<\/li>\n<li>M\u00e9canisme similaire de mise \u00e0 jour de la configuration dans un fichier chiffr\u00e9 [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf\" target=\"_blank\" rel=\"noopener\">11<\/a>]\u00a0;<\/li>\n<li>Similarit\u00e9s fonctionnelles dans l'architecture globale des implants : utilisation de threads pour parall\u00e9liser les commandes et utilisation d'\u00e9v\u00e8nements pour la synchronisation [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">8<\/a>]\u00a0;<\/li>\n<li>Similarit\u00e9s dans les protocoles de communication entre M\u00e9lof\u00e9e, CrowDoor et RatelS [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">8<\/a>, <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/\" target=\"_blank\" rel=\"noopener\">12<\/a>]\u00a0;<\/li>\n<li>M\u00e9canisme de gestion des modules par application d'un masque de bits sur l'ID de commande et liste cha\u00een\u00e9e [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>, <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/\" target=\"_blank\" rel=\"noopener\">12<\/a>]\u00a0;<\/li>\n<li>Le nom d'export utilis\u00e9 pour le chargement des modules est tr\u00e8s similaire : xmain pour M\u00e9lof\u00e9e, fmain pour RatelS et CrowDoor [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">8<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf\" target=\"_blank\" rel=\"noopener\">11<\/a>, <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/\" target=\"_blank\" rel=\"noopener\">12<\/a>]\u00a0;<\/li>\n<li>Exposition d'une interface \u00e0 chaque module (PluginInterface vs PlgInterface) [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>].<\/li>\n<\/ul>\n<p>Par ailleurs, comme le montre le tableau suivant, les noms de classes utilis\u00e9s dans les modules de CrowDoor sont identiques\u00a0:<\/p>\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_3\"\n     id='ninja_table_builder_845087'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_3\"\n     style=\"\n     max-height:1000px;\n     max-width: 700px;margin-left: auto; margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845087 ntb_845087\" style=\"margin: 0px auto; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_9112187\" id=\"tr_id_9112187\" data-draggable=\"true\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_30793859\" class=\"td_class_30793859 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_30793859\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_80\" spellcheck=\"false\"><strong>Identifiant CrowDoor<\/strong><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_49767417\" class=\"td_class_49767417 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_49767417\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_81\" spellcheck=\"false\"><strong>Identifiant M\u00e9lof\u00e9e<\/strong><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16744151\" class=\"td_class_16744151 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16744151\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_82\" spellcheck=\"false\"><strong>Nom de classe utilis\u00e9e dans les modules CrowDoor<\/strong><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4887839\" id=\"tr_id_4887839\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_27313596\" class=\"td_class_27313596 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27313596\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_83\" spellcheck=\"false\">0x60000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68240271\" class=\"td_class_68240271 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68240271\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_84\" spellcheck=\"false\">0x2000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27703185\" class=\"td_class_27703185 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27703185\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_85\" spellcheck=\"false\">CShell<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2783646\" id=\"tr_id_2783646\" data-draggable=\"true\"><td id=\"td_id_29648964\" class=\"td_class_29648964 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29648964\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_86\" spellcheck=\"false\">0x30000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_55491414\" class=\"td_class_55491414 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_55491414\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_87\" spellcheck=\"false\">0x3000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16643343\" class=\"td_class_16643343 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16643343\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_88\" spellcheck=\"false\">CFile<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4498477\" id=\"tr_id_4498477\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_76480319\" class=\"td_class_76480319 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_76480319\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_89\" spellcheck=\"false\">0x20000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_48698001\" class=\"td_class_48698001 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 125px; min-width: 125px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48698001\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_90\" spellcheck=\"false\">0x4000<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_43934236\" class=\"td_class_43934236 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 300px; min-width: 300px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43934236\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_91\" spellcheck=\"false\">CCmd<\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<p>Avec un niveau de confiance \u00e9lev\u00e9e, nous estimons que M\u00e9lof\u00e9e est tr\u00e8s probablement li\u00e9 \u00e0 ces diff\u00e9rentes familles de codes malveillants, et est potentiellement d\u00e9velopp\u00e9 par les m\u00eames \u00e9quipes.<\/p>\n<p>Par ailleurs, ces similarit\u00e9s montrent un probable partage d'outils entre diff\u00e9rents groupes d'attaquants, ce qui est d\u00e9j\u00e0 \u00e9voqu\u00e9 par plusieurs publications \u00e9tudiant ces implants [<a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">5<\/a>, <a href=\"https:\/\/blog.talosintelligence.com\/uat-9244\/\" target=\"_blank\" rel=\"noopener\">7<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">8<\/a>, <a href=\"https:\/\/blog-en.itochuci.co.jp\/entry\/2023\/10\/06\/173200\" target=\"_blank\" rel=\"noopener\">9<\/a>, <a href=\"https:\/\/www.trendaisecurity.com\/en-us\/resources-insights\/trendai-security-blog\/premier-pass-as-a-service\" target=\"_blank\" rel=\"noopener\">10<\/a>, <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf\" target=\"_blank\" rel=\"noopener\">11<\/a>, <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/\" target=\"_blank\" rel=\"noopener\">12<\/a>].<\/p>\n<h2>D\u00e9tection via les firewalls Stormshield<\/h2>\n<p>Au sein de nos firewalls Stormshield Network Security (SNS), plusieurs signatures d\u00e9di\u00e9es \u00e0 la d\u00e9tection de l'activit\u00e9 M\u00e9lof\u00e9e sont d\u00e9j\u00e0 en place\u00a0:<\/p>\n<ul>\n<li>ssl:server:certificate.107 : signature permettant de d\u00e9tecter l'utilisation de certificats utilis\u00e9s par M\u00e9lof\u00e9e\u00a0;<\/li>\n<li>tcp:client:port.68 : signature d\u00e9tectant l'envoi d'un paquet d'enregistrement par un implant M\u00e9lof\u00e9e \u00e0 un serveur C2.<\/li>\n<\/ul>\n<p>Selon le niveau d'IDS\/IPS configur\u00e9, les firewalls SNS l\u00e8veront des alarmes voire bloqueront les paquets que ces signatures permettront d'identifier.<\/p>\n<p>Sur l'interface de votre SNS, vous pourrez retrouver les alarmes lev\u00e9es dans la partie Monitoring - Logs\/Journaux d'audit - Alarmes [<a href=\"https:\/\/documentation.stormshield.eu\/SNS\/v4\/fr\/Content\/User_Configuration_Manual_SNS_v4\/Audit_Logs\/Logs-List_of_Views.htm\" target=\"_blank\" rel=\"noopener\">14<\/a>].<\/p>\n<h2>Conclusion<\/h2>\n<p><strong>L'analyse des nouveaux \u00e9chantillons de M\u00e9lof\u00e9e montre que cette famille d'implants est toujours active et en \u00e9volution continue, pr\u00e8s de trois ans apr\u00e8s sa d\u00e9couverte.<\/strong><\/p>\n<p>Les \u00e9volutions majeures identifi\u00e9es, telle que la modularisation de fonctions historiquement int\u00e9gr\u00e9es \u00e0 l'implant et l'ajout de commandes permettant de reconfigurer \u00e0 distance l'infrastructure C2 montrent une maturation de l'outillage utilis\u00e9 par les attaquants.<\/p>\n<p>Par ailleurs, les similarit\u00e9s structurelles du code soutiennent l'hypoth\u00e8se d'un partage de code entre plusieurs groupes d'attaquants probablement li\u00e9s \u00e0 des int\u00e9r\u00eats \u00e9tatiques chinois , ce qui complexifie la t\u00e2che des d\u00e9fenseurs et brouille l'attribution bas\u00e9e uniquement sur les outils.<\/p>\n<h2>R\u00e9f\u00e9rences<\/h2>\n<ul>\n<li>[1] ExaTrack, M\u00e9lof\u00e9e: a new alien malware in the Panda's toolset targeting Linux hosts, March 28, 2023 - <a href=\"https:\/\/blog.exatrack.com\/melofee\/\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.exatrack.com\/melofee\/<\/a><\/li>\n<li>[2] Reptile rootkit - <a href=\"https:\/\/github.com\/R3x\/linux-rootkits\/blob\/main\/Reptile\/kernel\/main.c\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/R3x\/linux-rootkits\/blob\/main\/Reptile\/kernel\/main.c<\/a><\/li>\n<li>[3] AhnLab ASEC, Reptile Malware Targeting Linux Systems, July 20, 2023 - <a href=\"https:\/\/asec.ahnlab.com\/en\/55785\/\" target=\"_blank\" rel=\"noopener\">https:\/\/asec.ahnlab.com\/en\/55785\/<\/a><\/li>\n<li>[4] XLab (Qianxin), New Zero-Detection Variant of Melofee Backdoor from Winnti Strikes RHEL 7.9, November 12, 2024 - <a href=\"https:\/\/blog.xlab.qianxin.com\/analysis_of_new_melofee_variant_en\/\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.xlab.qianxin.com\/analysis_of_new_melofee_variant_en\/<\/a><\/li>\n<li>[5] ESET Research, You will always remember this as the day you finally caught FamousSparrow, March 26, 2025 - <a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.welivesecurity.com\/en\/eset-research\/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow\/<\/a><\/li>\n<li>[6] HuntIO , Tracking ShadowPad Infrastructure Via Non-Standard Certificates, Feb 9, 2024 - <a href=\"https:\/\/hunt.io\/blog\/tracking-shadowpad-infrastructure-via-non-standard-certificates\" target=\"_blank\" rel=\"noopener\">https:\/\/hunt.io\/blog\/tracking-shadowpad-infrastructure-via-non-standard-certificates<\/a><\/li>\n<li>[7] Cisco Talos, UAT-9244 targets South American telecommunication providers with three new malware implants, March 5, 2026 - <a href=\"https:\/\/blog.talosintelligence.com\/uat-9244\/\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.talosintelligence.com\/uat-9244\/<\/a><\/li>\n<li>[8] Cyber Defense Institute, Inc\/TrendMicro, The Secret Life of RATs: connecting the dots by dissecting multiple backdoors, 2024 - <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf\" target=\"_blank\" rel=\"noopener\">https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf<\/a><\/li>\n<li>[9] ITOCHU Cyber &amp; Intelligence Inc, Sequel: Gifts from Tropical Pirates - Who is the Sender? Look for the Attacker Group, 2023 - <a href=\"https:\/\/blog-en.itochuci.co.jp\/entry\/2023\/10\/06\/173200\" target=\"_blank\" rel=\"noopener\">https:\/\/blog-en.itochuci.co.jp\/entry\/2023\/10\/06\/173200<\/a><\/li>\n<li>[10] Daniel Lunghi , Leon M Chang, Trend Micro, The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns, October 22nd, 2025 - <a href=\"https:\/\/www.trendaisecurity.com\/en-us\/resources-insights\/trendai-security-blog\/premier-pass-as-a-service\" target=\"_blank\" rel=\"noopener\">https:\/\/www.trendaisecurity.com\/en-us\/resources-insights\/trendai-security-blog\/premier-pass-as-a-service<\/a><\/li>\n<li>[11] Yi-Chin Chuang, Yu-Tung Chang, Team T5, Unveiling TeleBoyi: Chinese APT Group Targeting Critical Infrastructure Worldwide, 2024 - <a href=\"https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf\" target=\"_blank\" rel=\"noopener\">https:\/\/jsac.jpcert.or.jp\/archive\/2024\/pdf\/JSAC2024_1_8_yi-chin_yu-tung_en.pdf<\/a><\/li>\n<li>[12] Yoshihiro Ishikawa, Takuma Matsumoto, LAC Co.,Ltd., New Modular Malware RatelS: Shades of PlugX - <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.botconf.eu\/botconf-presentation-or-article\/new-modular-malware-ratels-shades-of-plugx\/<\/a><\/li>\n<li>[13] General Purpose Hash Function Algorithms - <a href=\"https:\/\/www.partow.net\/programming\/hashfunctions\/#JSHashFunction\" target=\"_blank\" rel=\"noopener\">https:\/\/www.partow.net\/programming\/hashfunctions\/#JSHashFunction<\/a><\/li>\n<li>[14] Stormshield, Manuel Utilisateur SNS v4 - Logs-List of Views, 2026 - <a href=\"https:\/\/documentation.stormshield.eu\/SNS\/v4\/fr\/Content\/User_Configuration_Manual_SNS_v4\/Audit_Logs\/Logs-List_of_Views.htm\" target=\"_blank\" rel=\"noopener\">https:\/\/documentation.stormshield.eu\/SNS\/v4\/fr\/Content\/User_Configuration_Manual_SNS_v4\/Audit_Logs\/Logs-List_of_Views.htm<\/a><\/li>\n<li>[15] APT41, MITRE ATT&amp;CK\u00ae - <a href=\"https:\/\/attack.mitre.org\/groups\/G0096\/\" target=\"_blank\" rel=\"noopener\">https:\/\/attack.mitre.org\/groups\/G0096\/<\/a><\/li>\n<\/ul>\n<h2>Annexes<\/h2>\n<h3>Mapping des techniques observ\u00e9es (MITRE ATT&amp;CK)<\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-845056 size-large\" src=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image4-1024x795.png\" alt=\"\" width=\"1024\" height=\"795\" srcset=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image4-1024x795.png 1024w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image4-300x233.png 300w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image4-768x597.png 768w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image4-700x544.png 700w, https:\/\/www.stormshield.com\/wp-content\/uploads\/stormshield-cti-melofee-image4.png 1062w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<h3>IOCs<\/h3>\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_4\"\n     id='ninja_table_builder_845088'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_4\"\n     style=\"\n     max-height:2000px;\n     max-width: 700px;margin-left: auto; margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845088 ntb_845088\" style=\"margin: 0px auto; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_5259710\" id=\"tr_id_5259710\" data-draggable=\"true\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_59897305\" class=\"td_class_59897305 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_59897305\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_0\" spellcheck=\"false\">Type<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_66317307\" class=\"td_class_66317307 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_66317307\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_2\" spellcheck=\"false\">Usage<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15552471\" class=\"td_class_15552471 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15552471\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_3\" spellcheck=\"false\">Valeur<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_99237170\" class=\"td_class_99237170 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_99237170\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_4\" spellcheck=\"false\">Description and remarque<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4123427\" id=\"tr_id_4123427\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_78094315\" class=\"td_class_78094315 table-data\" rowspan=\"1\" colspan=\"4\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78094315\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_5\" spellcheck=\"false\">Implants<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_43461747\" class=\"td_class_43461747 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 100px; min-width: 100px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43461747\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_6\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Implants<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22578251\" class=\"td_class_22578251 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22578251\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_7\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_58299501\" class=\"td_class_58299501 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_58299501\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_8\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3480369\" id=\"tr_id_3480369\" data-draggable=\"true\"><td id=\"td_id_24011407\" class=\"td_class_24011407 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_24011407\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_9\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_80653201\" class=\"td_class_80653201 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_80653201\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_10\" spellcheck=\"false\">Backdoor<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_26058085\" class=\"td_class_26058085 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_26058085\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_11\" spellcheck=\"false\">8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22732638\" class=\"td_class_22732638 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22732638\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_12\" spellcheck=\"false\">Implant Linux&nbsp;<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7500504\" id=\"tr_id_7500504\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_10582595\" class=\"td_class_10582595 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10582595\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_13\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_63154787\" class=\"td_class_63154787 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63154787\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_14\" spellcheck=\"false\">Backdoor<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_46416112\" class=\"td_class_46416112 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_46416112\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_15\" spellcheck=\"false\">dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13897818\" class=\"td_class_13897818 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13897818\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_16\" spellcheck=\"false\">Implant Linux <\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5054240\" id=\"tr_id_5054240\" data-draggable=\"true\"><td id=\"td_id_78966151\" class=\"td_class_78966151 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78966151\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_17\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27489735\" class=\"td_class_27489735 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27489735\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_18\" spellcheck=\"false\">Backdoor<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27115914\" class=\"td_class_27115914 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27115914\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_19\" spellcheck=\"false\">50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_21586123\" class=\"td_class_21586123 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_21586123\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_20\" spellcheck=\"false\">Implant Linux <\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5451191\" id=\"tr_id_5451191\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_29557487\" class=\"td_class_29557487 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29557487\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_21\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16738970\" class=\"td_class_16738970 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16738970\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_22\" spellcheck=\"false\">Backdoor<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_20742580\" class=\"td_class_20742580 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_20742580\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_23\" spellcheck=\"false\">4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16820242\" class=\"td_class_16820242 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16820242\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_24\" spellcheck=\"false\">Implant Linux (ancienne version)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3356540\" id=\"tr_id_3356540\" data-draggable=\"true\"><td id=\"td_id_64660233\" class=\"td_class_64660233 table-data\" rowspan=\"1\" colspan=\"4\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_64660233\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_25\" spellcheck=\"false\">Rootkits<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_71037909\" class=\"td_class_71037909 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 100px; min-width: 100px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71037909\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_26\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_40039242\" class=\"td_class_40039242 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_40039242\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_27\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_11333091\" class=\"td_class_11333091 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_11333091\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_28\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Rootkits<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7388250\" id=\"tr_id_7388250\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_49965626\" class=\"td_class_49965626 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_49965626\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_29\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68465332\" class=\"td_class_68465332 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68465332\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_30\" spellcheck=\"false\">Rootkit<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_48994396\" class=\"td_class_48994396 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48994396\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_31\" spellcheck=\"false\">aa2fd252a6f5a09b8d8422fbd1037febefe2aa99317e3c3973889384a80e29b7<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_90526943\" class=\"td_class_90526943 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_90526943\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_32\" spellcheck=\"false\">Rootkit embarqu\u00e9 au sein de l'implant \"50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8\"<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1270044\" id=\"tr_id_1270044\" data-draggable=\"true\"><td id=\"td_id_99928936\" class=\"td_class_99928936 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_99928936\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_33\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53196070\" class=\"td_class_53196070 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53196070\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_34\" spellcheck=\"false\">Rootkit<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13177446\" class=\"td_class_13177446 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13177446\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_35\" spellcheck=\"false\">6678216ace0ff224d6a5ae6bf1ca29e66fba9fceaa715e27440e85d5bfb06069<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15209295\" class=\"td_class_15209295 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15209295\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_36\" spellcheck=\"false\">Rootkit embarqu\u00e9 au sein de l'implant \"dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9\"<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9432889\" id=\"tr_id_9432889\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_90777572\" class=\"td_class_90777572 table-data\" rowspan=\"1\" colspan=\"4\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_90777572\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_37\" spellcheck=\"false\">Modules<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_63067381\" class=\"td_class_63067381 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 100px; min-width: 100px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63067381\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_38\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_41653711\" class=\"td_class_41653711 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_41653711\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_39\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_21896737\" class=\"td_class_21896737 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_21896737\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_40\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Modules<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9544095\" id=\"tr_id_9544095\" data-draggable=\"true\"><td id=\"td_id_63249709\" class=\"td_class_63249709 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63249709\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_41\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_10866913\" class=\"td_class_10866913 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10866913\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_42\" spellcheck=\"false\">Module<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53006617\" class=\"td_class_53006617 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53006617\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_43\" spellcheck=\"false\">129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_34262948\" class=\"td_class_34262948 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_34262948\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_44\" spellcheck=\"false\">Module d\u2019ex\u00e9cution de commandes \u00e0 distance<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2411333\" id=\"tr_id_2411333\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_31489440\" class=\"td_class_31489440 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_31489440\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_45\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15997091\" class=\"td_class_15997091 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15997091\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_46\" spellcheck=\"false\">Module<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_44970838\" class=\"td_class_44970838 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_44970838\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_47\" spellcheck=\"false\">9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_95398373\" class=\"td_class_95398373 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_95398373\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_48\" spellcheck=\"false\">Module de gestion des fichiers et des r\u00e9pertoires<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4943533\" id=\"tr_id_4943533\" data-draggable=\"true\"><td id=\"td_id_89195627\" class=\"td_class_89195627 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_89195627\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_49\" spellcheck=\"false\">HASH<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16475927\" class=\"td_class_16475927 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16475927\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_50\" spellcheck=\"false\">Module<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_98670350\" class=\"td_class_98670350 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_98670350\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_51\" spellcheck=\"false\">cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_25370426\" class=\"td_class_25370426 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_25370426\"><div class=\"single-item item-active other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_52\" spellcheck=\"false\">Module pour le Shell interactif<\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_5\"\n     id='ninja_table_builder_845089'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_5\"\n     style=\"\n     max-height:5000px;\n     max-width: 700px;margin-left: auto; margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845089 ntb_845089\" style=\"margin: 0px auto; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_4123427\" id=\"tr_id_4123427\" data-draggable=\"true\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_78094315\" class=\"td_class_78094315 table-data\" rowspan=\"1\" colspan=\"4\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78094315\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_0\" spellcheck=\"false\">Infrastructure Cluster \"Symantec\"<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_43461747\" class=\"td_class_43461747 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 100px; min-width: 100px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43461747\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_2\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Implants<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22578251\" class=\"td_class_22578251 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22578251\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_3\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_58299501\" class=\"td_class_58299501 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_58299501\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_4\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3480369\" id=\"tr_id_3480369\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_24011407\" class=\"td_class_24011407 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_24011407\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_5\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_80653201\" class=\"td_class_80653201 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_80653201\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_6\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_26058085\" class=\"td_class_26058085 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_26058085\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_7\" spellcheck=\"false\">windefender[.]net:443<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22732638\" class=\"td_class_22732638 table-data\" rowspan=\"2\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22732638\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_8\" spellcheck=\"false\">Associ\u00e9 \u00e0 l'implant \"50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8\"<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7500504\" id=\"tr_id_7500504\" data-draggable=\"true\"><td id=\"td_id_10582595\" class=\"td_class_10582595 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10582595\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_9\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_63154787\" class=\"td_class_63154787 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63154787\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_10\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_46416112\" class=\"td_class_46416112 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_46416112\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_11\" spellcheck=\"false\">www[.]windefender[.]net:443<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13897818\" class=\"td_class_13897818 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13897818\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_12\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Linux Implant<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5054240\" id=\"tr_id_5054240\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_78966151\" class=\"td_class_78966151 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78966151\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_13\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27489735\" class=\"td_class_27489735 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27489735\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_14\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27115914\" class=\"td_class_27115914 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27115914\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_15\" spellcheck=\"false\">103[.]215[.]216[.]117:443<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_21586123\" class=\"td_class_21586123 table-data\" rowspan=\"2\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_21586123\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_16\" spellcheck=\"false\">Associ\u00e9 \u00e0 l'implant \"8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf\"<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5451191\" id=\"tr_id_5451191\" data-draggable=\"true\"><td id=\"td_id_29557487\" class=\"td_class_29557487 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29557487\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_17\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16738970\" class=\"td_class_16738970 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16738970\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_18\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_20742580\" class=\"td_class_20742580 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_20742580\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_19\" spellcheck=\"false\">89[.]44[.]198[.]107:443<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16820242\" class=\"td_class_16820242 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16820242\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_20\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">x<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7388250\" id=\"tr_id_7388250\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_49965626\" class=\"td_class_49965626 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_49965626\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_21\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68465332\" class=\"td_class_68465332 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68465332\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_22\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_48994396\" class=\"td_class_48994396 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48994396\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_23\" spellcheck=\"false\">92.38.169[.]152<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_90526943\" class=\"td_class_90526943 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_90526943\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_24\" spellcheck=\"false\">R\u00e9solution DNS du domaine windefender[.]net<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1270044\" id=\"tr_id_1270044\" data-draggable=\"true\"><td id=\"td_id_99928936\" class=\"td_class_99928936 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_99928936\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_25\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53196070\" class=\"td_class_53196070 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53196070\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_26\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13177446\" class=\"td_class_13177446 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13177446\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_27\" spellcheck=\"false\">38.54.71[.]107<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15209295\" class=\"td_class_15209295 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15209295\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_28\" spellcheck=\"false\">R\u00e9solution DNS du domaine windefender[.]net (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9544095\" id=\"tr_id_9544095\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_63249709\" class=\"td_class_63249709 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63249709\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_29\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_10866913\" class=\"td_class_10866913 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10866913\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_30\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53006617\" class=\"td_class_53006617 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53006617\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_31\" spellcheck=\"false\">130.94.91[.]53<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_34262948\" class=\"td_class_34262948 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_34262948\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_32\" spellcheck=\"false\">R\u00e9solution DNS du domaine windefender[.]net (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2411333\" id=\"tr_id_2411333\" data-draggable=\"true\"><td id=\"td_id_31489440\" class=\"td_class_31489440 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_31489440\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_33\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15997091\" class=\"td_class_15997091 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15997091\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_34\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_44970838\" class=\"td_class_44970838 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_44970838\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_35\" spellcheck=\"false\">38.54.71[.]56<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_95398373\" class=\"td_class_95398373 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_95398373\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_36\" spellcheck=\"false\">R\u00e9solution DNS du domaine windefender[.]net (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4943533\" id=\"tr_id_4943533\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_89195627\" class=\"td_class_89195627 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_89195627\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_37\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16475927\" class=\"td_class_16475927 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16475927\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_38\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_98670350\" class=\"td_class_98670350 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_98670350\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_39\" spellcheck=\"false\">windowsupdates[.]us:80<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_25370426\" class=\"td_class_25370426 table-data\" rowspan=\"2\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_25370426\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_40\" spellcheck=\"false\">Associ\u00e9 \u00e0 l'implant \"dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9\"<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_8812919\" id=\"tr_id_8812919\" data-draggable=\"true\"><td id=\"td_id_72712427\" class=\"td_class_72712427 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_72712427\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_41\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_77701134\" class=\"td_class_77701134 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77701134\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_42\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_34874817\" class=\"td_class_34874817 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_34874817\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_43\" spellcheck=\"false\">45[.]80[.]208[.]232:80<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_18117381\" class=\"td_class_18117381 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 150px; min-width: 150px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_18117381\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_44\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Associated to implant \"dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9\"<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_6768818\" id=\"tr_id_6768818\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_28811779\" class=\"td_class_28811779 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_28811779\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_45\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_17776774\" class=\"td_class_17776774 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_17776774\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_46\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16841892\" class=\"td_class_16841892 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16841892\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_47\" spellcheck=\"false\">185.163.2[.]100<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_71611424\" class=\"td_class_71611424 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71611424\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_48\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7877671\" id=\"tr_id_7877671\" data-draggable=\"true\"><td id=\"td_id_48989778\" class=\"td_class_48989778 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48989778\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_49\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_61891558\" class=\"td_class_61891558 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_61891558\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_50\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_78817876\" class=\"td_class_78817876 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78817876\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_51\" spellcheck=\"false\">microsoftupdates[.]top<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_89774754\" class=\"td_class_89774754 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_89774754\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_52\" spellcheck=\"false\">Domaine r\u00e9solvant vers 185.163.2[.]100<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_0808117\" id=\"tr_id_0808117\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_87911817\" class=\"td_class_87911817 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_87911817\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_53\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_97979111\" class=\"td_class_97979111 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_97979111\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_54\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_11748877\" class=\"td_class_11748877 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_11748877\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_55\" spellcheck=\"false\">180.149.44[.]115<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_78844884\" class=\"td_class_78844884 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78844884\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_56\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_8913878\" id=\"tr_id_8913878\" data-draggable=\"true\"><td id=\"td_id_77144193\" class=\"td_class_77144193 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77144193\"><div class=\"single-item other-item\" data-draggable=\"true\" draggable=\"false\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_57\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_84133881\" class=\"td_class_84133881 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_84133881\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_58\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_19848871\" class=\"td_class_19848871 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_19848871\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_59\" spellcheck=\"false\">windowsupdates[.]us<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_99949971\" class=\"td_class_99949971 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_99949971\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_60\" spellcheck=\"false\">Domaine r\u00e9solvant vers 180.149.44[.]115<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4681687\" id=\"tr_id_4681687\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_94183783\" class=\"td_class_94183783 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_94183783\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_61\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_11376718\" class=\"td_class_11376718 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_11376718\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_62\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_85884876\" class=\"td_class_85884876 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_85884876\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_63\" spellcheck=\"false\">103.215.216[.]181<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_71818119\" class=\"td_class_71818119 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71818119\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_64\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7847979\" id=\"tr_id_7847979\" data-draggable=\"true\"><td id=\"td_id_77181787\" class=\"td_class_77181787 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77181787\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_65\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_78146479\" class=\"td_class_78146479 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78146479\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_66\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_47887719\" class=\"td_class_47887719 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_47887719\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_67\" spellcheck=\"false\">microupdate[.]top<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_48768781\" class=\"td_class_48768781 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48768781\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_68\" spellcheck=\"false\">Domaine r\u00e9solvant vers 103.215.216[.]181<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2988998\" id=\"tr_id_2988998\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_11797898\" class=\"td_class_11797898 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_11797898\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_69\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_88859971\" class=\"td_class_88859971 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_88859971\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_70\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_51978885\" class=\"td_class_51978885 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_51978885\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_71\" spellcheck=\"false\">103.215.216[.]75<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_28122798\" class=\"td_class_28122798 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_28122798\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_72\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1000205\" id=\"tr_id_1000205\" data-draggable=\"true\"><td id=\"td_id_41508886\" class=\"td_class_41508886 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_41508886\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_73\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_08050181\" class=\"td_class_08050181 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_08050181\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_74\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_82674619\" class=\"td_class_82674619 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_82674619\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_75\" spellcheck=\"false\">103.215.216[.]117<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_86050842\" class=\"td_class_86050842 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_86050842\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_76\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1119759\" id=\"tr_id_1119759\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_48228954\" class=\"td_class_48228954 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48228954\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_77\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22840859\" class=\"td_class_22840859 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22840859\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_78\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_11971915\" class=\"td_class_11971915 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_11971915\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_79\" spellcheck=\"false\">103.215.216[.]116<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_69022264\" class=\"td_class_69022264 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_69022264\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_80\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_8851975\" id=\"tr_id_8851975\" data-draggable=\"true\"><td id=\"td_id_58177722\" class=\"td_class_58177722 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_58177722\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_81\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_98954750\" class=\"td_class_98954750 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_98954750\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_82\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_77478977\" class=\"td_class_77478977 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77478977\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_83\" spellcheck=\"false\">103.215.216[.]27<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_57870771\" class=\"td_class_57870771 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_57870771\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_84\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5829995\" id=\"tr_id_5829995\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_57985289\" class=\"td_class_57985289 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_57985289\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_85\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_78289424\" class=\"td_class_78289424 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78289424\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_86\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_88247912\" class=\"td_class_88247912 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_88247912\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_87\" spellcheck=\"false\">microupdate[.]me<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_47089107\" class=\"td_class_47089107 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_47089107\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_88\" spellcheck=\"false\">Domaine r\u00e9solvant vers 103.215.216[.]27<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9895227\" id=\"tr_id_9895227\" data-draggable=\"true\"><td id=\"td_id_17185521\" class=\"td_class_17185521 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_17185521\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_89\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_55141221\" class=\"td_class_55141221 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_55141221\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_90\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_79418892\" class=\"td_class_79418892 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_79418892\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_91\" spellcheck=\"false\">46.246.98[.]131<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_72925272\" class=\"td_class_72925272 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_72925272\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_92\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2483233\" id=\"tr_id_2483233\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_97247894\" class=\"td_class_97247894 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_97247894\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_93\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_63764926\" class=\"td_class_63764926 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63764926\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_94\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_59898167\" class=\"td_class_59898167 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_59898167\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_95\" spellcheck=\"false\">185.163.2[.]34<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_91426782\" class=\"td_class_91426782 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_91426782\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_96\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5876805\" id=\"tr_id_5876805\" data-draggable=\"true\"><td id=\"td_id_37552467\" class=\"td_class_37552467 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_37552467\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_97\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_76352808\" class=\"td_class_76352808 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_76352808\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_98\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_88985581\" class=\"td_class_88985581 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_88985581\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_99\" spellcheck=\"false\">185.163.2[.]79<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_12488068\" class=\"td_class_12488068 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_12488068\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_100\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3221818\" id=\"tr_id_3221818\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_59756559\" class=\"td_class_59756559 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_59756559\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_101\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_85199218\" class=\"td_class_85199218 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_85199218\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_102\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_85156928\" class=\"td_class_85156928 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_85156928\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_103\" spellcheck=\"false\">185.163.2[.]81<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_85986171\" class=\"td_class_85986171 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_85986171\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_104\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_4592842\" id=\"tr_id_4592842\" data-draggable=\"true\"><td id=\"td_id_82775958\" class=\"td_class_82775958 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_82775958\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_105\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_98192185\" class=\"td_class_98192185 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_98192185\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_106\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_41153818\" class=\"td_class_41153818 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_41153818\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_107\" spellcheck=\"false\">23.95.34[.]184<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22748534\" class=\"td_class_22748534 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22748534\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_108\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5999824\" id=\"tr_id_5999824\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_81848158\" class=\"td_class_81848158 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_81848158\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_109\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_88444499\" class=\"td_class_88444499 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_88444499\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_110\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_41499271\" class=\"td_class_41499271 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_41499271\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_111\" spellcheck=\"false\">172.86.114[.]201<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_44597294\" class=\"td_class_44597294 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_44597294\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_112\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1259918\" id=\"tr_id_1259918\" data-draggable=\"true\"><td id=\"td_id_44218851\" class=\"td_class_44218851 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_44218851\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_113\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_14982359\" class=\"td_class_14982359 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_14982359\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_114\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_24783287\" class=\"td_class_24783287 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_24783287\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_115\" spellcheck=\"false\">130.94.91[.]165<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_76524586\" class=\"td_class_76524586 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_76524586\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_116\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_8591028\" id=\"tr_id_8591028\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_82421582\" class=\"td_class_82421582 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_82421582\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_117\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_52145709\" class=\"td_class_52145709 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_52145709\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_118\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_75555854\" class=\"td_class_75555854 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_75555854\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_119\" spellcheck=\"false\">103.87.9[.]148<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_91554508\" class=\"td_class_91554508 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_91554508\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_120\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1251655\" id=\"tr_id_1251655\" data-draggable=\"true\"><td id=\"td_id_95682521\" class=\"td_class_95682521 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_95682521\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_121\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_86126512\" class=\"td_class_86126512 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_86126512\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_122\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_29815957\" class=\"td_class_29815957 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29815957\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_123\" spellcheck=\"false\">45.67.230[.]185<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_52862588\" class=\"td_class_52862588 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_52862588\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_124\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5851989\" id=\"tr_id_5851989\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_19585209\" class=\"td_class_19585209 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_19585209\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_125\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_98555058\" class=\"td_class_98555058 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_98555058\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_126\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_21855858\" class=\"td_class_21855858 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_21855858\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_127\" spellcheck=\"false\">154.205.137[.]88<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22257722\" class=\"td_class_22257722 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22257722\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_128\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1937980\" id=\"tr_id_1937980\" data-draggable=\"true\"><td id=\"td_id_72321015\" class=\"td_class_72321015 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_72321015\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_129\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_08879010\" class=\"td_class_08879010 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_08879010\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_130\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_89787988\" class=\"td_class_89787988 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_89787988\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_131\" spellcheck=\"false\">146.71.85[.]33<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_07987720\" class=\"td_class_07987720 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_07987720\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_132\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3999139\" id=\"tr_id_3999139\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_86871968\" class=\"td_class_86871968 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_86871968\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_133\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_66973187\" class=\"td_class_66973187 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_66973187\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_134\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_98818768\" class=\"td_class_98818768 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_98818768\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_135\" spellcheck=\"false\">103.215.216[.]162<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_89593188\" class=\"td_class_89593188 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_89593188\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_136\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7718717\" id=\"tr_id_7718717\" data-draggable=\"true\"><td id=\"td_id_17881179\" class=\"td_class_17881179 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_17881179\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_137\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_11889568\" class=\"td_class_11889568 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_11889568\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_138\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_71517596\" class=\"td_class_71517596 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_71517596\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_139\" spellcheck=\"false\">103.215.216[.]61<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_74488751\" class=\"td_class_74488751 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_74488751\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_140\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5735888\" id=\"tr_id_5735888\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_88087288\" class=\"td_class_88087288 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_88087288\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_141\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_81700532\" class=\"td_class_81700532 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_81700532\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_142\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_70881031\" class=\"td_class_70881031 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_70881031\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_143\" spellcheck=\"false\">180.149.44[.]43<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_77988093\" class=\"td_class_77988093 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 150px; min-width: 150px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_77988093\"><div class=\"single-item item-active other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_144\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat dbbcb279a1f1a258832174ce63c295c5080de249)<\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_6\"\n     id='ninja_table_builder_845090'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_6\"\n     style=\"\n     max-height:5000px;\n     max-width: 700px;margin-left: auto; margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845090 ntb_845090\" style=\"margin: 0px auto; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_4123427\" id=\"tr_id_4123427\" data-draggable=\"true\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_78094315\" class=\"td_class_78094315 table-data\" rowspan=\"1\" colspan=\"4\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78094315\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_0\" spellcheck=\"false\">Infrastructure Cluster \"xdevops\"<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_43461747\" class=\"td_class_43461747 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 100px; min-width: 100px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43461747\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_2\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Implants<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22578251\" class=\"td_class_22578251 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22578251\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_3\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_58299501\" class=\"td_class_58299501 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_58299501\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_4\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3480369\" id=\"tr_id_3480369\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_24011407\" class=\"td_class_24011407 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_24011407\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_5\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_80653201\" class=\"td_class_80653201 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_80653201\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_6\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_26058085\" class=\"td_class_26058085 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_26058085\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_7\" spellcheck=\"false\">awsclouds.awspull[.]com<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22732638\" class=\"td_class_22732638 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22732638\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_8\" spellcheck=\"false\">Associ\u00e9 \u00e0 l'implant \"4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59\"<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7500504\" id=\"tr_id_7500504\" data-draggable=\"true\"><td id=\"td_id_10582595\" class=\"td_class_10582595 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10582595\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_9\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_63154787\" class=\"td_class_63154787 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63154787\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_10\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_46416112\" class=\"td_class_46416112 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_46416112\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_11\" spellcheck=\"false\">192.3.55[.]220<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13897818\" class=\"td_class_13897818 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13897818\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_12\" spellcheck=\"false\">Associ\u00e9 \u00e0 l'implant \"4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59\", ayant r\u00e9solu le domaine awsclouds.awspull[.]com et ayant expos\u00e9 le certificat 0c1666b274ddb44dd5c7a11f03c8c041f6bccf0c7dae924626ef9d15b1cc41d5<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5054240\" id=\"tr_id_5054240\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_78966151\" class=\"td_class_78966151 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78966151\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_13\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27489735\" class=\"td_class_27489735 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27489735\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_14\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27115914\" class=\"td_class_27115914 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27115914\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_15\" spellcheck=\"false\">38.54.110[.]44<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_21586123\" class=\"td_class_21586123 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_21586123\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_16\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat b6df18f66cf4364be2946d6b981e69763aafde68)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5451191\" id=\"tr_id_5451191\" data-draggable=\"true\"><td id=\"td_id_29557487\" class=\"td_class_29557487 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29557487\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_17\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16738970\" class=\"td_class_16738970 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16738970\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_18\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_20742580\" class=\"td_class_20742580 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_20742580\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_19\" spellcheck=\"false\">45.61.148[.]33<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16820242\" class=\"td_class_16820242 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16820242\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_20\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat b6df18f66cf4364be2946d6b981e69763aafde68)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7388250\" id=\"tr_id_7388250\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_49965626\" class=\"td_class_49965626 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_49965626\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_21\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68465332\" class=\"td_class_68465332 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68465332\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_22\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_48994396\" class=\"td_class_48994396 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48994396\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_23\" spellcheck=\"false\">2.56.166[.]139<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_90526943\" class=\"td_class_90526943 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_90526943\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_24\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat b6df18f66cf4364be2946d6b981e69763aafde68)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_1270044\" id=\"tr_id_1270044\" data-draggable=\"true\"><td id=\"td_id_99928936\" class=\"td_class_99928936 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_99928936\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_25\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53196070\" class=\"td_class_53196070 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53196070\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_26\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13177446\" class=\"td_class_13177446 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13177446\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_27\" spellcheck=\"false\">update.wwwubuntu[.]com<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15209295\" class=\"td_class_15209295 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15209295\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_28\" spellcheck=\"false\">Probable C2 (ayant r\u00e9solu vers plusieurs adresses IP r\u00e9solu vers 38.54.110[.]44, 45.61.148[.]33, 2.56.166[.]139)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_9544095\" id=\"tr_id_9544095\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_63249709\" class=\"td_class_63249709 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63249709\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_29\" spellcheck=\"false\">IP<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_10866913\" class=\"td_class_10866913 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10866913\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_30\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_53006617\" class=\"td_class_53006617 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_53006617\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_31\" spellcheck=\"false\">2.56.166[.]84<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_34262948\" class=\"td_class_34262948 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_34262948\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_32\" spellcheck=\"false\">Probable C2 (ayant expos\u00e9 le certificat b6df18f66cf4364be2946d6b981e69763aafde68)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_2411333\" id=\"tr_id_2411333\" data-draggable=\"true\"><td id=\"td_id_31489440\" class=\"td_class_31489440 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_31489440\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_33\" spellcheck=\"false\">Domaine<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_15997091\" class=\"td_class_15997091 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_15997091\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_34\" spellcheck=\"false\">C2<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_44970838\" class=\"td_class_44970838 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_44970838\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_35\" spellcheck=\"false\">amzaonaws[.]org<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_95398373\" class=\"td_class_95398373 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_95398373\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_36\" spellcheck=\"false\">Probable C2 (ayant r\u00e9solu vers 2.56.166[.]84)<\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<div class=\"ntb_table_wrapper ninja_table_builder_instance_7\"\n     id='ninja_table_builder_845091'\n     data-ninja_table_builder_instance=\"ninja_table_builder_instance_7\"\n     style=\"\n     max-height:5000px;\n     max-width: 700px;margin-left: auto; margin-right: auto;\">\n    <table id=\"ntb_table\" role=\"table\" class=\"table ninja_tables_builder_class_845091 ntb_845091\" style=\"margin: 0px auto; table-layout: fixed; border-collapse: collapse; border: 0px solid rgb(0, 0, 0); font-family: inherit; border-spacing: 0px;\"><tbody class=\"tbody\"><tr class=\"desktop-view tr_class_4123427\" id=\"tr_id_4123427\" data-draggable=\"true\" style=\"background: rgb(221, 221, 221);\"><td id=\"td_id_78094315\" class=\"td_class_78094315 table-data\" rowspan=\"1\" colspan=\"4\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78094315\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_0\" spellcheck=\"false\">Fichiers<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_43461747\" class=\"td_class_43461747 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 100px; min-width: 100px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_43461747\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" id=\"mce_2\" style=\"padding: 0px; font-weight: bold; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" spellcheck=\"false\">Implants<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22578251\" class=\"td_class_22578251 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 225px; min-width: 225px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22578251\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_3\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><td id=\"td_id_58299501\" class=\"td_class_58299501 table-data\" rowspan=\"0\" colspan=\"0\" style=\"padding: 12px; max-width: 200px; min-width: 200px; display: none; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_58299501\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"placeholder hover-item mce-content-body\" id=\"mce_4\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: center; color: rgb(0, 0, 1); opacity: 0.4; line-height: 1.2;\" spellcheck=\"false\"><br data-mce-bogus=\"1\"><\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_3480369\" id=\"tr_id_3480369\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_24011407\" class=\"td_class_24011407 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_24011407\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_5\" spellcheck=\"false\">Path<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_80653201\" class=\"td_class_80653201 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_80653201\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_6\" spellcheck=\"false\">IOC<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_26058085\" class=\"td_class_26058085 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_26058085\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_7\" spellcheck=\"false\">\/tmp\/lock_ax<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_22732638\" class=\"td_class_22732638 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_22732638\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_8\" spellcheck=\"false\">Mutex utilis\u00e9 par l'implant<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7500504\" id=\"tr_id_7500504\" data-draggable=\"true\"><td id=\"td_id_10582595\" class=\"td_class_10582595 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_10582595\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_9\" spellcheck=\"false\">Path<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_63154787\" class=\"td_class_63154787 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_63154787\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_10\" spellcheck=\"false\">IOC<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_46416112\" class=\"td_class_46416112 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_46416112\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_11\" spellcheck=\"false\">\/tmp\/[ID]<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_13897818\" class=\"td_class_13897818 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_13897818\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_12\" spellcheck=\"false\">Fichier temporaire utilis\u00e9 pour stocker les modules (ID \u00e9tant compris entre 2000 et c000)<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5054240\" id=\"tr_id_5054240\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_78966151\" class=\"td_class_78966151 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_78966151\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_13\" spellcheck=\"false\">Path<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27489735\" class=\"td_class_27489735 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27489735\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_14\" spellcheck=\"false\">IOC<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_27115914\" class=\"td_class_27115914 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_27115914\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_15\" spellcheck=\"false\">\/etc\/systemd\/system\/vmware.service<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_21586123\" class=\"td_class_21586123 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_21586123\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_16\" spellcheck=\"false\">Fichier utilis\u00e9 pour la persistance<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_5451191\" id=\"tr_id_5451191\" data-draggable=\"true\"><td id=\"td_id_29557487\" class=\"td_class_29557487 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_29557487\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_17\" spellcheck=\"false\">Path<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16738970\" class=\"td_class_16738970 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16738970\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_18\" spellcheck=\"false\">IOC<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_20742580\" class=\"td_class_20742580 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_20742580\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_19\" spellcheck=\"false\">\/tmp\/.mpwzlof<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_16820242\" class=\"td_class_16820242 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_16820242\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 2px 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_20\" spellcheck=\"false\">Fichier utilis\u00e9 pour installer la persistance<\/span><\/div><\/div><\/div><\/td><\/tr><tr class=\"desktop-view tr_class_7388250\" id=\"tr_id_7388250\" data-draggable=\"true\" style=\"background: rgb(255, 255, 255);\"><td id=\"td_id_49965626\" class=\"td_class_49965626 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_49965626\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_21\" spellcheck=\"false\">Process Name<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_68465332\" class=\"td_class_68465332 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 100px; min-width: 100px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_68465332\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_22\" spellcheck=\"false\">IOC<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_48994396\" class=\"td_class_48994396 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 225px; min-width: 225px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_48994396\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_23\" spellcheck=\"false\">[md]<\/span><\/div><\/div><\/div><\/td><td id=\"td_id_90526943\" class=\"td_class_90526943 table-data\" rowspan=\"1\" colspan=\"1\" style=\"padding: 12px; max-width: 200px; min-width: 200px; border: 1px solid rgb(0, 0, 0);\"><div id=\"cell_90526943\"><div class=\"single-item other-item\" data-draggable=\"true\"><div class=\"ntb-datas-wrapper\" style=\"margin: 1px;\"><span data-v-bd450b80=\"\" data-placeholder=\"Add New\" class=\"hover-item mce-content-body\" style=\"padding: 0px; font-weight: normal; font-style: normal; text-decoration: none; font-size: 12px; display: block; text-align: left; color: rgb(0, 0, 1); opacity: 1; line-height: 1.2; position: relative;\" id=\"mce_24\" spellcheck=\"false\">Nom de processus (hors kernel)<\/span><\/div><\/div><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n\n<h3>Signatures Yara, Sigma et SNS (Stormshield)<\/h3>\n<h4>Signatures Yara<\/h4>\n<p>[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code>rule <span style=\"color: #333399;\">UNK_APT_MelofeeImplant_2026<\/span><\/code><\/p>\n<p><code>{<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>meta:<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>description = <span style=\"color: #008000;\">\"Detects Melofee Linux implant\"<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>author      = <span style=\"color: #008000;\">\"romain.carette - (Stormshield CTI)\"<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>family      = <span style=\"color: #008000;\">\"Melofee\"<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>hashes = <span style=\"color: #008000;\">\"50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8,dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9,8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf\"<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>created        = <span style=\"color: #008000;\">\"2026-08-15\"<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>modified       = <span style=\"color: #008000;\">\"2026-09-02\"<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>score          = <span style=\"color: #0000ff;\">100<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>tlp            = <span style=\"color: #008000;\">\"TLP-CLEAR\"<\/span><\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>strings:<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>$sym_xmain = <span style=\"color: #008000;\">\"xmain\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><em><code>\/\/ This functionality allows incoming TCP traffic to be redirected to a local port and is used by Melofee to implement a network redirection mechanism.<\/code><\/em><\/p>\n<p style=\"padding-left: 80px;\"><code>$iptables_add = <span style=\"color: #008000;\">\"iptables -t nat -A PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-port %d\"<\/span> ascii<br \/>\n<\/code><code>$iptables_del = <span style=\"color: #008000;\">\"iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-port %d\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>$pevents_src = <span style=\"color: #008000;\">\"pevents.cpp\"<\/span> ascii<br \/>\n$pevents_ns1 = <span style=\"color: #008000;\">\"neosmart::CreateEventx\"<\/span> ascii<br \/>\n$pevents_ns2 = <span style=\"color: #008000;\">\"neosmart::WaitForMultipleEvents\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>$code_initmod = {<\/code><\/p>\n<p style=\"padding-left: 120px;\"><code>b9 ?? ?? ?? ??<br \/>\n<span style=\"color: #0000ff;\">48 89<\/span> da<br \/>\n<span style=\"color: #0000ff;\">48 89<\/span> c6<br \/>\nbf af <span style=\"color: #0000ff;\">00 00 00<\/span><br \/>\nb8 <span style=\"color: #0000ff;\">00 00 00 00<\/span><br \/>\ne8<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>}<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>$code_selfdelete = {<\/code><\/p>\n<p style=\"padding-left: 120px;\"><code>bf ?? ?? ?? ??<br \/>\ne8 ?? ?? ?? ??<br \/>\n<span style=\"color: #0000ff;\">89 45<\/span> ??<br \/>\n<span style=\"color: #0000ff;\">83 7d<\/span> ?? <span style=\"color: #0000ff;\">00<\/span><br \/>\n<span style=\"color: #0000ff;\">0f 8<\/span>e ?? ?? ?? ??<br \/>\n<span style=\"color: #0000ff;\">8<\/span>b <span style=\"color: #0000ff;\">45<\/span> ??<br \/>\n<span style=\"color: #0000ff;\">48 98<\/span><br \/>\nc6 <span style=\"color: #0000ff;\">84 05<\/span> ?? ?? ?? ?? <span style=\"color: #0000ff;\">00<\/span><\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>}<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>condition:<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>uint32(<span style=\"color: #0000ff;\">0<\/span>) == <span style=\"color: #0000ff;\">0x464c457f<\/span> and<br \/>\n<span style=\"color: #0000ff;\">3<\/span> of them<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>}<\/code><\/p>\n<p><code>rule <span style=\"color: #333399;\">UNK_APT_MelofeeImplantLib<\/span><br \/>\n{<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>meta:<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>description = <span style=\"color: #008000;\">\"Detects plugin libraries (.so) of the Melofee Linux implant family\"<\/span><br \/>\nauthor = <span style=\"color: #008000;\">\"romain.carette - Stormshield CTI\"<\/span><br \/>\ndate = <span style=\"color: #008000;\">\"2026-08-24\"<\/span><br \/>\nmalware_family = <span style=\"color: #008000;\">\"Melofee\"<\/span><br \/>\nhashes = <span style=\"color: #008000;\">\"9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4,cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae,129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427\"<\/span><br \/>\ncreated = <span style=\"color: #008000;\">\"2026-08-15\"<\/span><br \/>\nmodified = <span style=\"color: #008000;\">\"2026-09-02\"<\/span><br \/>\nscore = <span style=\"color: #0000ff;\">100<\/span><br \/>\ntlp = <span style=\"color: #008000;\">\"TLP-CLEAR\"<\/span><\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>strings:<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code><em>\/\/ SocketApi network layer<\/em><br \/>\n$sock1 = <span style=\"color: #008000;\">\"_ZN9SocketApi7ConnectEiPK8sockaddri\"<\/span> ascii<br \/>\n$sock2 = <span style=\"color: #008000;\">\"_ZN9SocketApi6SocketEiiiRi\"<\/span> ascii<br \/>\n$sock3 = <span style=\"color: #008000;\">\"_ZN9SocketApi6ListenEii\"<\/span> ascii<br \/>\n$sock4 = <span style=\"color: #008000;\">\"_ZN9SocketApi6AcceptEiP8sockaddrPiRi\"<\/span> ascii<br \/>\n$sock5 = <span style=\"color: #008000;\">\"_ZN9SocketApi4SendEiPKviRi\"<\/span> ascii<br \/>\n$sock6 = <span style=\"color: #008000;\">\"_ZN9SocketApi4RecvEiPviRi\"<\/span> ascii<br \/>\n$sock7 = <span style=\"color: #008000;\">\"_ZN9SocketApi4PeekEiPviRi\"<\/span> ascii<br \/>\n$sock8 = <span style=\"color: #008000;\">\"_ZN9SocketApi4BindEiPK8sockaddri\"<\/span> ascii<br \/>\n$sock9 = <span style=\"color: #008000;\">\"_ZN9SocketApi13GetAddrInfo_xEPKcS1_PK8addrinfoPPS2_\"<\/span> ascii<br \/>\n$sock10 = <span style=\"color: #008000;\">\"_ZN9SocketApi18FreeAddrInfoWrap_xEP8addrinfo\"<\/span> ascii<br \/>\n$sock11 = <span style=\"color: #008000;\">\"_ZN9SocketApi11GetsocknameEiP8sockaddrPi\"<\/span> ascii<br \/>\n$sock12 = <span style=\"color: #008000;\">\"_ZN9SocketApi11GetpeernameEiP8sockaddrPi\"<\/span> ascii<br \/>\n$sock13 = <span style=\"color: #008000;\">\"_ZN9SocketApi5CloseEi\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code><em>\/\/ BaseConn connection wrapper<\/em><br \/>\n$conn1 = <span style=\"color: #008000;\">\"_ZN8BaseConn5sendnEPvi\"<\/span> ascii<br \/>\n$conn2 = <span style=\"color: #008000;\">\"_ZN8BaseConn5recvnEPvim\"<\/span> ascii<br \/>\n$conn3 = <span style=\"color: #008000;\">\"_ZN8BaseConn4peekEPviRim\"<\/span> ascii<br \/>\n$conn4 = <span style=\"color: #008000;\">\"_ZTI8BaseConn\"<\/span> ascii<br \/>\n$conn5 = <span style=\"color: #008000;\">\"_ZTV8BaseConn\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code><em>\/\/ Packet handling + RC4<\/em><br \/>\n$pkt1 = <span style=\"color: #008000;\">\"_Z11WritePacketSt10shared_ptrI8BaseConnEP9_PkHeaderSs\"<\/span> ascii<br \/>\n$pkt2 = <span style=\"color: #008000;\">\"_Z10ReadPacketSt10shared_ptrI8BaseConnEP9_PkHeaderRSs\"<\/span> ascii<br \/>\n$rc4_1 = <span style=\"color: #008000;\">\"_Z6re_RC4PhPc\"<\/span> ascii<br \/>\n$rc4_2 = <span style=\"color: #008000;\">\"_Z7re_SboxPhS_\"<\/span> ascii<br \/>\n$rc4_3 = <span style=\"color: #008000;\">\"_Z5RC4_2Pci\"<\/span> ascii<br \/>\n$rc4_4 = <span style=\"color: #008000;\">\"_Z3RC4PciS_\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code><em>\/\/ Network helpers<\/em><br \/>\n$hton1 = <span style=\"color: #008000;\">\"_Z9my_htonllm\"<\/span> ascii<br \/>\n$hton2 = <span style=\"color: #008000;\">\"_Z8my_htonst\"<\/span> ascii<br \/>\n$hton3 = <span style=\"color: #008000;\">\"_Z8my_htonlj\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code><em>\/\/ Shared internal string utilities<\/em><br \/>\n$util1 = <span style=\"color: #008000;\">\"_Z5splitRKSsS0_RSt6vectorISsSaISsEE\"<\/span> ascii<br \/>\n$util2 = <span style=\"color: #008000;\">\"_Z4joinRKSt6vectorISsSaISsEERKSs\"<\/span> ascii<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code><em>\/\/ Plugin entry point symbol<\/em><br \/>\n$entry = <span style=\"color: #008000;\">\"xmain\"<\/span> ascii fullword<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>condition:<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>uint32(<span style=\"color: #0000ff;\">0<\/span>) == <span style=\"color: #0000ff;\">0x464c457f<\/span> and <em>\/\/ ELF magic<\/em><br \/>\nuint16(<span style=\"color: #0000ff;\">16<\/span>) == <span style=\"color: #0000ff;\">3<\/span> and <em>\/\/ e_type == ET_DYN (shared object)<\/em><br \/>\n(<\/code><\/p>\n<p style=\"padding-left: 120px;\"><code><span style=\"color: #0000ff;\">6<\/span> of ($sock*)<br \/>\nor <span style=\"color: #0000ff;\">2<\/span> of ($conn*)<br \/>\nor <span style=\"color: #0000ff;\">10<\/span> of them<br \/>\nor ($entry and <span style=\"color: #0000ff;\">2<\/span> of ($sock*, $conn*))<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code>)<\/code><\/p>\n<p><code>}<\/code>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\"][vc_column][vc_empty_space][vc_column_text css=\"\"]<\/p>\n<h4>Signature Sigma<\/h4>\n<p>[\/vc_column_text][vc_empty_space][\/vc_column][\/vc_row][vc_row css_animation=\"\" row_type=\"row\" use_row_as_full_screen_section=\"no\" type=\"full_width\" angled_section=\"no\" text_align=\"left\" background_image_as_pattern=\"without_pattern\" el_class=\"fond_gris\" z_index=\"\" padding_top=\"32\" padding_bottom=\"32\" css=\".vc_custom_1788963484950{padding-right: 32px !important;padding-left: 32px !important;}\"][vc_column][vc_column_text css=\"\"]<code>title: <span style=\"color: #333399;\">Detection<\/span> of temporary files used by M\u00e9lof\u00e9e <span style=\"color: #0000ff;\"><strong>for module<\/strong> storage<\/span><\/code><\/p>\n<p><code>id: <span style=\"color: #0000ff;\">8e6f2<\/span>a3c-<span style=\"color: #0000ff;\">4<\/span>b7d-<span style=\"color: #0000ff;\">4e1<\/span>a-<span style=\"color: #0000ff;\">9<\/span>c2f-<span style=\"color: #0000ff;\">5d8<\/span>a1b3e7f90<\/code><\/p>\n<p><code>status: experimental<\/code><\/p>\n<p><code>description: <span style=\"color: #333399;\">Detects<\/span> the creation, in \/tmp\/, of temporary files whose names correspond <span style=\"color: #0000ff;\"><strong>to<\/strong> a<\/span> hexadecimal <span style=\"color: #333399;\">identifier<\/span>. <span style=\"color: #333399;\">These<\/span> files are used <span style=\"color: #0000ff;\"><strong>to<\/strong> store<\/span> modules\/plugins that will subsequently be loaded via <span style=\"color: #333399;\">dlopen<\/span>. <span style=\"color: #333399;\">The<\/span> filename corresponds <span style=\"color: #0000ff;\"><strong>to<\/strong> a<\/span> hexadecimal identifier ranging from <span style=\"color: #0000ff;\">0x2000 <strong>to<\/strong> 0xC000<\/span>.<\/code><\/p>\n<p><code>references:<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>- <span style=\"color: #333399;\">Stormshield<\/span> CTI <span style=\"color: #333399;\">Internal Analysis<\/span> \u2013 M\u00e9lof\u00e9e <span style=\"color: #333399;\">Linux Implant<\/span><\/code><\/p>\n<p><code>author: romain.carette - (<span style=\"color: #333399;\">Stormshield<\/span> CTI)<\/code><\/p>\n<p><code>date: <span style=\"color: #0000ff;\">2026-08-26<\/span><\/code><\/p>\n<p><code>tags:<\/code><\/p>\n<p><code>logsource:<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>product: linux<br \/>\ncategory: file_event<\/code><\/p>\n<p><code>detection:<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>selection:<\/code><\/p>\n<p style=\"padding-left: 80px;\"><code><span style=\"color: #333399;\">TargetFilename<\/span>|re: '^\/tmp\/[<span style=\"color: #0000ff;\">2<\/span>-<span style=\"color: #0000ff;\">9<\/span>a-cA-C]<span style=\"color: #0000ff;\">000<\/span>$'<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>condition: selection<\/code><\/p>\n<p><code>falsepositives:<\/code><\/p>\n<p style=\"padding-left: 40px;\"><code>- <span style=\"color: #333399;\">Legitimate<\/span> temporary files <span style=\"color: #0000ff;\"><strong>with<\/strong> randomly<\/span> generated hexadecimal names (rare but possible)<\/code><\/p>\n<p><code>level: medium<\/code>[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>[vc_row css_animation=\u00a0\u00bb\u00a0\u00bb row_type=\u00a0\u00bbrow\u00a0\u00bb use_row_as_full_screen_section=\u00a0\u00bbno\u00a0\u00bb type=\u00a0\u00bbfull_width\u00a0\u00bb angled_section=\u00a0\u00bbno\u00a0\u00bb text_align=\u00a0\u00bbleft\u00a0\u00bb background_image_as_pattern=\u00a0\u00bbwithout_pattern\u00a0\u00bb][vc_column][vc_column_text css=\u00a0\u00bb\u00a0\u00bb]M\u00e9lof\u00e9e revient, et il a \u00e9volu\u00e9\u00a0! Trois ans apr\u00e8s sa d\u00e9couverte, de nouveaux \u00e9chantillons de cet implant Linux se r\u00e9v\u00e8lent nettement plus sophistiqu\u00e9s\u00a0: d\u00e9composition en modules, chargeables et d\u00e9chargeables \u00e0 chaud, des fonctionnalit\u00e9s de shell, de fichiers&#8230;<\/p>\n","protected":false},"author":83,"featured_media":845115,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"categories":[7065],"tags":[4368],"business_size":[],"industry":[],"help_mefind":[],"features":[],"type_security":[],"maintenance":[],"offer":[],"administration_tools":[],"cloud_offers":[],"listing_product":[],"class_list":["post-845092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technical-posts-fr","tag-la-cybersecurite-par-stormshield"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Malware M\u00e9lof\u00e9e : Nouveaux Variants d&#039;un Implant Linux<\/title>\n<meta name=\"description\" content=\"M\u00e9lof\u00e9e a \u00e9t\u00e9 rep\u00e9r\u00e9 pour la premi\u00e8re fois en 2023. En enqu\u00eatant, nous avons identifi\u00e9 de nouveaux \u00e9chantillons li\u00e9s \u00e0 cette famille.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Malware M\u00e9lof\u00e9e : Nouveaux Variants d&#039;un Implant Linux\" \/>\n<meta property=\"og:description\" content=\"M\u00e9lof\u00e9e a \u00e9t\u00e9 rep\u00e9r\u00e9 pour la premi\u00e8re fois en 2023. En enqu\u00eatant, nous avons identifi\u00e9 de nouveaux \u00e9chantillons li\u00e9s \u00e0 cette famille.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/\" \/>\n<meta property=\"og:site_name\" content=\"Stormshield\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-10T17:18:34+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-10T17:18:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock-1553327258-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"2560\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Stormshield Customer Security Lab\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Stormshield\" \/>\n<meta name=\"twitter:site\" content=\"@Stormshield\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Stormshield Customer Security Lab\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/\"},\"author\":{\"name\":\"Stormshield Customer Security Lab\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#\\\/schema\\\/person\\\/a05f467cec789f90c8a355b178743249\"},\"headline\":\"M\u00e9lof\u00e9e : retour sur un implant Linux et ses nouveaux variants\",\"datePublished\":\"2026-09-10T17:18:34+00:00\",\"dateModified\":\"2026-09-10T17:18:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/\"},\"wordCount\":5590,\"image\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock-1553327258-scaled.jpg\",\"keywords\":[\"La cybers\u00e9curit\u00e9 - par Stormshield\"],\"articleSection\":[\"Billets techniques\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/\",\"url\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/\",\"name\":\"Malware M\u00e9lof\u00e9e : Nouveaux Variants d'un Implant Linux\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock-1553327258-scaled.jpg\",\"datePublished\":\"2026-09-10T17:18:34+00:00\",\"dateModified\":\"2026-09-10T17:18:44+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#\\\/schema\\\/person\\\/a05f467cec789f90c8a355b178743249\"},\"description\":\"M\u00e9lof\u00e9e a \u00e9t\u00e9 rep\u00e9r\u00e9 pour la premi\u00e8re fois en 2023. En enqu\u00eatant, nous avons identifi\u00e9 de nouveaux \u00e9chantillons li\u00e9s \u00e0 cette famille.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock-1553327258-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/www.stormshield.com\\\/wp-content\\\/uploads\\\/shutterstock-1553327258-scaled.jpg\",\"width\":2560,\"height\":2560},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/actus\\\/cti-melofee-linux-implant-nouveaux-variants\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"M\u00e9lof\u00e9e : retour sur un implant Linux et ses nouveaux variants\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#website\",\"url\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/\",\"name\":\"Stormshield\",\"description\":\"Stormshield\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.stormshield.com\\\/fr\\\/#\\\/schema\\\/person\\\/a05f467cec789f90c8a355b178743249\",\"name\":\"Stormshield Customer Security Lab\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/46b9416c400398c1a9fc878c7a35bd2ae4f79caeeda138facd5cb65a4ab91c5d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/46b9416c400398c1a9fc878c7a35bd2ae4f79caeeda138facd5cb65a4ab91c5d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/46b9416c400398c1a9fc878c7a35bd2ae4f79caeeda138facd5cb65a4ab91c5d?s=96&d=mm&r=g\",\"caption\":\"Stormshield Customer Security Lab\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Malware M\u00e9lof\u00e9e : Nouveaux Variants d'un Implant Linux","description":"M\u00e9lof\u00e9e a \u00e9t\u00e9 rep\u00e9r\u00e9 pour la premi\u00e8re fois en 2023. En enqu\u00eatant, nous avons identifi\u00e9 de nouveaux \u00e9chantillons li\u00e9s \u00e0 cette famille.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/","og_locale":"fr_FR","og_type":"article","og_title":"Malware M\u00e9lof\u00e9e : Nouveaux Variants d'un Implant Linux","og_description":"M\u00e9lof\u00e9e a \u00e9t\u00e9 rep\u00e9r\u00e9 pour la premi\u00e8re fois en 2023. En enqu\u00eatant, nous avons identifi\u00e9 de nouveaux \u00e9chantillons li\u00e9s \u00e0 cette famille.","og_url":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/","og_site_name":"Stormshield","article_published_time":"2026-09-10T17:18:34+00:00","article_modified_time":"2026-09-10T17:18:44+00:00","og_image":[{"width":2560,"height":2560,"url":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock-1553327258-scaled.jpg","type":"image\/jpeg"}],"author":"Stormshield Customer Security Lab","twitter_card":"summary_large_image","twitter_creator":"@Stormshield","twitter_site":"@Stormshield","twitter_misc":{"\u00c9crit par":"Stormshield Customer Security Lab","Dur\u00e9e de lecture estim\u00e9e":"18 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/#article","isPartOf":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/"},"author":{"name":"Stormshield Customer Security Lab","@id":"https:\/\/www.stormshield.com\/fr\/#\/schema\/person\/a05f467cec789f90c8a355b178743249"},"headline":"M\u00e9lof\u00e9e : retour sur un implant Linux et ses nouveaux variants","datePublished":"2026-09-10T17:18:34+00:00","dateModified":"2026-09-10T17:18:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/"},"wordCount":5590,"image":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock-1553327258-scaled.jpg","keywords":["La cybers\u00e9curit\u00e9 - par Stormshield"],"articleSection":["Billets techniques"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/","url":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/","name":"Malware M\u00e9lof\u00e9e : Nouveaux Variants d'un Implant Linux","isPartOf":{"@id":"https:\/\/www.stormshield.com\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/#primaryimage"},"image":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock-1553327258-scaled.jpg","datePublished":"2026-09-10T17:18:34+00:00","dateModified":"2026-09-10T17:18:44+00:00","author":{"@id":"https:\/\/www.stormshield.com\/fr\/#\/schema\/person\/a05f467cec789f90c8a355b178743249"},"description":"M\u00e9lof\u00e9e a \u00e9t\u00e9 rep\u00e9r\u00e9 pour la premi\u00e8re fois en 2023. En enqu\u00eatant, nous avons identifi\u00e9 de nouveaux \u00e9chantillons li\u00e9s \u00e0 cette famille.","breadcrumb":{"@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/#primaryimage","url":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock-1553327258-scaled.jpg","contentUrl":"https:\/\/www.stormshield.com\/wp-content\/uploads\/shutterstock-1553327258-scaled.jpg","width":2560,"height":2560},{"@type":"BreadcrumbList","@id":"https:\/\/www.stormshield.com\/fr\/actus\/cti-melofee-linux-implant-nouveaux-variants\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.stormshield.com\/fr\/"},{"@type":"ListItem","position":2,"name":"M\u00e9lof\u00e9e : retour sur un implant Linux et ses nouveaux variants"}]},{"@type":"WebSite","@id":"https:\/\/www.stormshield.com\/fr\/#website","url":"https:\/\/www.stormshield.com\/fr\/","name":"Stormshield","description":"Stormshield","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.stormshield.com\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/www.stormshield.com\/fr\/#\/schema\/person\/a05f467cec789f90c8a355b178743249","name":"Stormshield Customer Security Lab","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/46b9416c400398c1a9fc878c7a35bd2ae4f79caeeda138facd5cb65a4ab91c5d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/46b9416c400398c1a9fc878c7a35bd2ae4f79caeeda138facd5cb65a4ab91c5d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/46b9416c400398c1a9fc878c7a35bd2ae4f79caeeda138facd5cb65a4ab91c5d?s=96&d=mm&r=g","caption":"Stormshield Customer Security Lab"}}]}},"_links":{"self":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts\/845092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/users\/83"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/comments?post=845092"}],"version-history":[{"count":4,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts\/845092\/revisions"}],"predecessor-version":[{"id":845114,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/posts\/845092\/revisions\/845114"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/media\/845115"}],"wp:attachment":[{"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/media?parent=845092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/categories?post=845092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/tags?post=845092"},{"taxonomy":"business_size","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/business_size?post=845092"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/industry?post=845092"},{"taxonomy":"help_mefind","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/help_mefind?post=845092"},{"taxonomy":"features","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/features?post=845092"},{"taxonomy":"type_security","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/type_security?post=845092"},{"taxonomy":"maintenance","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/maintenance?post=845092"},{"taxonomy":"offer","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/offer?post=845092"},{"taxonomy":"administration_tools","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/administration_tools?post=845092"},{"taxonomy":"cloud_offers","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/cloud_offers?post=845092"},{"taxonomy":"listing_product","embeddable":true,"href":"https:\/\/www.stormshield.com\/fr\/wp-json\/wp\/v2\/listing_product?post=845092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}