Back to Malware Drops
61302f5596119ba73a2dfe0437ea424d82d46dae6677c70fff2adba84a139a72
MD5c5dcf0105b58212b491a4475d4517afc
SSDEEP—
File Typetext/x-script
Size3.1 KB
Sources2
Downloads0
First SeenJun 4, 2021
Last SeenJun 4, 2021
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jun 4, 2021, 2:44:25 AMView attack session
- Dropped in this session (no command captured).Jun 4, 2021, 2:44:25 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 209[.]141[.]43[.]118
url (20)
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm4;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm4;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm5;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm5;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm6;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm6;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm7;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm7;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]m68k;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]m68k;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mips;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mips;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mpsl;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mpsl;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]ppc;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]ppc;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]sh4;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]sh4;cat
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]x86;
- hxxp://209[.]141[.]43[.]118/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]x86;cat