Back to Malware Drops
4e6a564d70f20e67b5ec8267dc596b745b4f0a5f9a0d3a4ba4ca41c74091cbfb
MD596bf1ccfa5c7089b10327940fbb646a9
SSDEEP—
File Typetext/x-script
Size2.2 KB
Sources7
Downloads0
First SeenMar 16, 2021
Last SeenMar 23, 2021
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Mar 16, 2021, 9:15:03 PMView attack session
- Dropped in this session (no command captured).Mar 16, 2021, 9:15:03 PMView attack session
- Dropped in this session (no command captured).Mar 16, 2021, 9:15:03 PMView attack session
- Dropped in this session (no command captured).Mar 16, 2021, 9:15:03 PMView attack session
- Dropped in this session (no command captured).Mar 16, 2021, 9:15:03 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 143[.]198[.]220[.]102
url (14)
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]arm4;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]arm5;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]arm6;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]arm7;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]i586;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]i686;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]m68k;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]mips;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]mpsl;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]ppc;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]ppc440fp;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]sh4;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]sparc;
- hxxp://143[.]198[.]220[.]102/Ecstasy[.]x86;