Sign In|Register
Back to Malware Drops

445d6566bd3935800306184df6264cac7ea48799d1cc21f60c7f2380419f6353

MD57c8a978b7ef8438dbe82802282bf15dc
SSDEEP—
File Typetext/x-script
Size2.2 KB
Sources30
Downloads0
First SeenDec 9, 2020
Last SeenDec 9, 2020
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 172[.]245[.]36[.]161

url (24)

  • hxxp://172[.]245[.]36[.]161/SBIDIOT/arm;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/arm6;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/arm6;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/arm7;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/arm7;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/arm;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/m68k;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/m68k;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/mips;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/mips;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/mpsl;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/mpsl;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/ppc;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/ppc;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/root;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/root;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/rtk;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/rtk;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/sh4;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/sh4;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/x86;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/x86;cat
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/zte;
  • hxxp://172[.]245[.]36[.]161/SBIDIOT/zte;cat