Back to Malware Drops
5fae9e3c6a9c3b487656d88ffc4a64ad7eab13d5a59cffd9c8238497ba048807
MD5291af919e6387b55e62f6fdd34cc9ddc
SSDEEP48:aQti5z8t4TEtiEcQstWWpMm3HAof7U38i8OLGftj5eBdwE7ywUcSydSFpmYPC5WM:Jam8BAXKums8KE88AXyaF3St+A7spRT
File Typetext/x-script
Size10.2 KB
Sources2
Downloads0
First SeenDec 16, 2024
Last SeenDec 16, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (1)
- bins[.]sh
ipv4 (1)
- 37[.]44[.]238[.]68
url (28)
- hxxp://37[.]44[.]238[.]68/bins/2QPd9yHO2ziTDpyvGt6SaHB7ZNIb70d5b8;
- hxxp://37[.]44[.]238[.]68/bins/2QPd9yHO2ziTDpyvGt6SaHB7ZNIb70d5b8;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/2StkTAjetcHiD50jpqsEDO9OyRk3QuRCbj;
- hxxp://37[.]44[.]238[.]68/bins/2StkTAjetcHiD50jpqsEDO9OyRk3QuRCbj;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/4wruVETgjb02lJJiSU8EwvbK61VLsvj0Rt;
- hxxp://37[.]44[.]238[.]68/bins/4wruVETgjb02lJJiSU8EwvbK61VLsvj0Rt;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/A2mOXvIeb3ypafIyBCX7trF5aGpWlakloo;
- hxxp://37[.]44[.]238[.]68/bins/A2mOXvIeb3ypafIyBCX7trF5aGpWlakloo;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/ApdD4xUdxgADoaGpll4AFUVwNrbaWVrGAV;
- hxxp://37[.]44[.]238[.]68/bins/ApdD4xUdxgADoaGpll4AFUVwNrbaWVrGAV;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/BqHCU8bOSx1Yji13FxBGYZGLkCWFt9YxyX;
- hxxp://37[.]44[.]238[.]68/bins/BqHCU8bOSx1Yji13FxBGYZGLkCWFt9YxyX;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/cr1MkJMLhBnC0CPqS9oImRe0JTFQ1lgtCh;
- hxxp://37[.]44[.]238[.]68/bins/cr1MkJMLhBnC0CPqS9oImRe0JTFQ1lgtCh;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/LfKzwrolbZjy1WnGsp8z5GWnD9kG4UKCoA;
- hxxp://37[.]44[.]238[.]68/bins/LfKzwrolbZjy1WnGsp8z5GWnD9kG4UKCoA;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/NBSaRvZEx3TPWg0NC8iZC79kxmk2XijWsz;
- hxxp://37[.]44[.]238[.]68/bins/NBSaRvZEx3TPWg0NC8iZC79kxmk2XijWsz;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/Pqj0KW33TtXFA9qWhZ1cx4FdWDYV7WxGan;
- hxxp://37[.]44[.]238[.]68/bins/Pqj0KW33TtXFA9qWhZ1cx4FdWDYV7WxGan;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/sRY9mvnwiin1SAxVdNq2VNExfswcar6EWo;
- hxxp://37[.]44[.]238[.]68/bins/sRY9mvnwiin1SAxVdNq2VNExfswcar6EWo;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/UITa5aPLm94lf79uRXSPjM8TNgwlHIjmgh;
- hxxp://37[.]44[.]238[.]68/bins/UITa5aPLm94lf79uRXSPjM8TNgwlHIjmgh;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/vvOuwoa8ZIkVYNMgQamBfJ8iB0FlS9u9GD;
- hxxp://37[.]44[.]238[.]68/bins/vvOuwoa8ZIkVYNMgQamBfJ8iB0FlS9u9GD;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/wHz7pLS4HexhzmuKm5Ng3yaOoUJQ70arZW;
- hxxp://37[.]44[.]238[.]68/bins/wHz7pLS4HexhzmuKm5Ng3yaOoUJQ70arZW;/bin/busybox