Back to Malware Drops
0903c318fb5079752372785871499d669c51ad6458b4c7816756870550ea5619
MD55bba3bb2fc3f1f0fc06da4ac5a43227b
SSDEEP—
File Typetext/x-script
Size1.9 KB
Sources1
Downloads0
First SeenDec 5, 2018
Last SeenDec 5, 2018
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Dec 5, 2018, 11:39:41 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 185[.]101[.]105[.]129
url (20)
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm4;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm4;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm5;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm5;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm6;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm6;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm7;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]arm7;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]m68k;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]m68k;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]mips;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]mips;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]mpsl;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]mpsl;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]ppc;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]ppc;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]sh4;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]sh4;cat
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]x86;
- hxxp://185[.]101[.]105[.]129/AB4g5/Omni[.]x86;cat