Back to Malware Drops
1f5bdf201b92f55d4132c479d043ab6bca387246177294ed1225b819cdcd3b1b
MD59d163ad44f4f6dc5e99d7b79e449b732
SSDEEP—
File Typetext/x-script
Size2.9 KB
Sources22
Downloads0
First SeenSep 23, 2022
Last SeenSep 23, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Sep 23, 2022, 5:31:49 AMView attack session
- Dropped in this session (no command captured).Sep 23, 2022, 5:31:49 AMView attack session
- Dropped in this session (no command captured).Sep 23, 2022, 5:31:49 AMView attack session
- Dropped in this session (no command captured).Sep 23, 2022, 5:31:49 AMView attack session
- Dropped in this session (no command captured).Sep 23, 2022, 5:31:49 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 46[.]19[.]141[.]122
url (15)
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]arc;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]arm;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]arm5;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]arm6;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]arm7;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]i486;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]i686;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]m68k;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]mips;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]mpsl;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]ppc;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]sh4;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]spc;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]x86;
- hxxp://46[.]19[.]141[.]122/drugs/meth[.]x86_64;