Back to Malware Drops
0196e30e7b8973dbac8dde718faff2ad00ea1aa452ebadcaf16edaf5e0acde14
MD5bc55dc81ea026a67a44886f2999b54ab
SSDEEP192:KMWHWXWGWfWLWq1bTMT3rDzX2n3PiwBtWdNvkSz4sRBtWdNGz4sWHWXWGWfWLWbF:b4DzX2n3PiVkGazX2n3/0
File Typetext/x-script
Size10.2 KB
Sources7
Downloads0
First SeenDec 13, 2024
Last SeenDec 13, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
btc (1)
- 37uMrDNMu2M3Eu5ihJnvhZNfmrvcMvi19J
domain (1)
- bins[.]sh
ipv4 (1)
- 37[.]44[.]238[.]68
url (28)
- hxxp://37[.]44[.]238[.]68/bins/37uMrDNMu2M3Eu5ihJnvhZNfmrvcMvi19J;
- hxxp://37[.]44[.]238[.]68/bins/37uMrDNMu2M3Eu5ihJnvhZNfmrvcMvi19J;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/CDze2HSU0BVUicsNBekeLhCB9oqZHJYjYX;
- hxxp://37[.]44[.]238[.]68/bins/CDze2HSU0BVUicsNBekeLhCB9oqZHJYjYX;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/D66Aigq6AObtzaMPolu1I1VEKJj8RPA57p;
- hxxp://37[.]44[.]238[.]68/bins/D66Aigq6AObtzaMPolu1I1VEKJj8RPA57p;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/GUnmh8nR1DFbySWS8sz7fbM6YdoKNs5aRZ;
- hxxp://37[.]44[.]238[.]68/bins/GUnmh8nR1DFbySWS8sz7fbM6YdoKNs5aRZ;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/JspFzn5MARAwHNfcBa1js3RI2bcPRDEPN8;
- hxxp://37[.]44[.]238[.]68/bins/JspFzn5MARAwHNfcBa1js3RI2bcPRDEPN8;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/lAKMISeUV2PhSu0DN3bVycJibusAQif91O;
- hxxp://37[.]44[.]238[.]68/bins/lAKMISeUV2PhSu0DN3bVycJibusAQif91O;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/o37g3zhYOAKuVSqvnNJFopJ1Z6tZYanTdj;
- hxxp://37[.]44[.]238[.]68/bins/o37g3zhYOAKuVSqvnNJFopJ1Z6tZYanTdj;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/olkUg3CZZsJq5AnuZa7VZvrE4YoCBeQFen;
- hxxp://37[.]44[.]238[.]68/bins/olkUg3CZZsJq5AnuZa7VZvrE4YoCBeQFen;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/QJAcVfs4zEbCItKDdvw6ze2k5AJcIklLht;
- hxxp://37[.]44[.]238[.]68/bins/QJAcVfs4zEbCItKDdvw6ze2k5AJcIklLht;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/tXIFj63TnqMlkF2xH7482jBU9X3oYbXxpf;
- hxxp://37[.]44[.]238[.]68/bins/tXIFj63TnqMlkF2xH7482jBU9X3oYbXxpf;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/wUOL7dC9955EeugsfDx9qFaaqUTH28a2IJ;
- hxxp://37[.]44[.]238[.]68/bins/wUOL7dC9955EeugsfDx9qFaaqUTH28a2IJ;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/YKtwXWZqroZJK0OREkUeil4uE1WCj7qpSE;
- hxxp://37[.]44[.]238[.]68/bins/YKtwXWZqroZJK0OREkUeil4uE1WCj7qpSE;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/YuuS7A8Wl0m0ZCtQNQ7BTgbisfrPDTXdwA;
- hxxp://37[.]44[.]238[.]68/bins/YuuS7A8Wl0m0ZCtQNQ7BTgbisfrPDTXdwA;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/zSpodtNKoe0ms882hD9ne1WIzwZYkcTRvO;
- hxxp://37[.]44[.]238[.]68/bins/zSpodtNKoe0ms882hD9ne1WIzwZYkcTRvO;/bin/busybox