Back to Malware Drops
18cd26bcdd77ba8c3a2cb1f37c376616edf9bd4c1c2b3a400521f22b72fc1cde
MD5d3cfcf8b51061caceaa9c2ff19fd903f
SSDEEP384:fGa9302/VZWmc0KL7j3GYUw6rvLxSqkHPh6h6MTDkGcjp9:f9930GVZqj3GYGrv9L8h6h6MTDkjp9
File Typetext/x-script
Size25.5 KB
Sources604
Downloads0
First SeenJan 4, 2023
Last SeenJan 6, 2023
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (17)
- alive[.]lst
- aliyun[.]service
- block[.]lst
- b[.]lst
- cron[.]hourly
- fbi[.]urlopen
- h[.]lst
- jira[.]letmaker[.]top
- ld[.]so[.]preload
- linux-d[.]service
- p[.]lst
- rc[.]local
- resolv[.]conf
- scan[.]lst
- uninstall[.]sh
- uninst[.]sh
- update[.]aegis[.]aliyun[.]com
ipv4 (5)
- 127[.]0[.]0[.]1
- 51[.]255[.]171[.]23
- 85[.]209[.]134[.]86
- 8[.]8[.]4[.]4
- 8[.]8[.]8[.]8
url (7)
- hxxp://85[.]209[.]134[.]86
- hxxp://85[.]209[.]134[.]86/xms
- hxxp://jira[.]letmaker[.]top
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh||curl
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh||curl