Sign In|Register
Back to Malware Drops

009f57e15afa42eb3603f34f9fd3e8f8a7ccc311f70075128292b8d2436f1cf0

MD5025f68b73bf18e95b13c407f5c37db63
SSDEEP—
File Typetext/x-script
Size2.1 KB
Sources95
Downloads0
First SeenSep 13, 2020
Last SeenSep 17, 2020
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 107[.]174[.]39[.]102

url (12)

  • hxxp://107[.]174[.]39[.]102/a-r[.]m-4[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/a-r[.]m-5[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/a-r[.]m-6[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/a-r[.]m-7[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/i-5[.]8-6[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/m-6[.]8-k[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/m-i[.]p-s[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/m-p[.]s-l[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/p-p[.]c-[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/s-h[.]4-[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/x-3[.]2-[.]SNOOPY;
  • hxxp://107[.]174[.]39[.]102/x-8[.]6-[.]SNOOPY;