Back to Malware Drops
1521ae629f701ea386738b5ad42c64e3c90a15adb8187d5e67d9671f78716d54
MD50244921df6f8d4e6818f02a9941588e5
SSDEEP—
File Typetext/x-script
Size2.2 KB
Sources206
Downloads0
First SeenDec 21, 2022
Last SeenJan 5, 2023
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (8)
- a-r[.]m-4[.]Fourloko
- a-r[.]m-5[.]Fourloko
- a-r[.]m-6[.]Fourloko
- a-r[.]m-7[.]Fourloko
- i-5[.]8-6[.]Fourloko
- m-6[.]8-k[.]Fourloko
- m-i[.]p-s[.]Fourloko
- m-p[.]s-l[.]Fourloko
ipv4 (1)
- 193[.]42[.]33[.]214
url (12)
- hxxp://193[.]42[.]33[.]214/a-r[.]m-4[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/a-r[.]m-5[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/a-r[.]m-6[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/a-r[.]m-7[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/i-5[.]8-6[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/m-6[.]8-k[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/m-i[.]p-s[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/m-p[.]s-l[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/p-p[.]c-[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/s-h[.]4-[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/x-3[.]2-[.]Fourloko;
- hxxp://193[.]42[.]33[.]214/x-8[.]6-[.]Fourloko;