Back to Malware Drops
06ed08c13a1525c20c42f752806cd5f0351abfcfaaad909b3ea9224665989fde
MD50fd8ffcefa88321899bbd8efa72eadd2
SSDEEP—
File Typetext/x-script
Size2.5 KB
Sources4
Downloads0
First SeenJul 31, 2020
Last SeenAug 2, 2020
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jul 31, 2020, 1:31:33 PMView attack session
- Dropped in this session (no command captured).Jul 31, 2020, 1:31:33 PMView attack session
- Dropped in this session (no command captured).Jul 31, 2020, 1:31:33 PMView attack session
- Dropped in this session (no command captured).Jul 31, 2020, 1:31:33 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 66[.]175[.]209[.]224
url (13)
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]arc;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]arm;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]arm5;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]arm6;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]arm7;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]i686;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]m68k;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]mips;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]mpsl;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]ppc;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]sh4;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]spc;
- hxxp://66[.]175[.]209[.]224/onii111/ch4n[.]x86;