c58c2c2ea608c83fad9326055a8271d47d8246dc9cb401e420c0971c67e19cbf

SHA256 of a compiled DLL generated from a human2.aspx LEMURLOOT payload, referenced in the Mandiant YARA rule M_Webshell_LEMURLOOT_DLL_1 included in AA23-158A as a hunting sample for the CL0P MOVEit zero-day intrusion set.

family

LEMURLOOT

first seen

May 31, 2023

publisher

CISA