Sign In|Register
Back to Malware Drops

3027a4353d17fef11c16bcf42d45402a919dc6d2cadce524f2a4e858e36b7bf3

MD55916b8bab7bf925074e319f26dbb3b22
SSDEEP—
File Typetext/x-script
Size2.1 KB
Sources8
Downloads0
First SeenSep 18, 2020
Last SeenSep 18, 2020
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 198[.]23[.]137[.]142

url (12)

  • hxxp://198[.]23[.]137[.]142/a-r[.]m-4[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/a-r[.]m-5[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/a-r[.]m-6[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/a-r[.]m-7[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/i-5[.]8-6[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/m-6[.]8-k[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/m-i[.]p-s[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/m-p[.]s-l[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/p-p[.]c-[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/s-h[.]4-[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/x-3[.]2-[.]SNOOPY;
  • hxxp://198[.]23[.]137[.]142/x-8[.]6-[.]SNOOPY;