Back to Malware Drops

28bd6c58465beec6b8939e7f7b54837f597d41728fca851ec9292158ea76cdc0

MD5ede74346d0fccd1f393b5e0e4581de08
SSDEEP
File Typetext/x-script
Size2.3 KB
Sources2
Downloads0
First SeenAug 8, 2022
Last SeenAug 8, 2022
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 103[.]153[.]141[.]243

url (26)

  • hxxp://103[.]153[.]141[.]243/idk/home[.]arc;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arc;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm5;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm5;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm6;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm6;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm7;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm7;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]arm;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]m68k;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]m68k;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]mips;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]mips;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]mpsl;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]mpsl;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]ppc;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]ppc;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]sh4;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]sh4;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]spc;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]spc;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]x86;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]x86_64;
  • hxxp://103[.]153[.]141[.]243/idk/home[.]x86_64;cat
  • hxxp://103[.]153[.]141[.]243/idk/home[.]x86;cat