Sign In|Register
Back to Malware Drops

282f8446b4bef4d4af9abaece826527b17560db930f165288e20e08fb34c062e

MD579cfe1b32fffd19deb0051f84c904924
SSDEEP—
File Typetext/x-script
Size2.1 KB
Sources27
Downloads0
First SeenNov 8, 2021
Last SeenNov 9, 2021
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 149[.]56[.]35[.]183

url (12)

  • hxxp://149[.]56[.]35[.]183/a-r[.]m-4[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/a-r[.]m-5[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/a-r[.]m-6[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/a-r[.]m-7[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/i-5[.]8-6[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/m-6[.]8-k[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/m-i[.]p-s[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/m-p[.]s-l[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/p-p[.]c-[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/s-h[.]4-[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/x-3[.]2-[.]skidnet;
  • hxxp://149[.]56[.]35[.]183/x-8[.]6-[.]skidnet;