Back to Malware Drops
61662114a6836546e30b3a1030125439345dc0625db125b37bce32ac2c1e6190
MD5c59a5eed0eb59e35a09e7a82d056aea7
SSDEEP—
File Typetext/x-script
Size2.0 KB
Sources53
Downloads0
First SeenMar 7, 2021
Last SeenMar 7, 2021
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Mar 7, 2021, 6:39:46 AMView attack session
- Dropped in this session (no command captured).Mar 7, 2021, 6:39:46 AMView attack session
- Dropped in this session (no command captured).Mar 7, 2021, 6:39:46 AMView attack session
- Dropped in this session (no command captured).Mar 7, 2021, 6:39:46 AMView attack session
- Dropped in this session (no command captured).Mar 7, 2021, 6:39:46 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 104[.]208[.]155[.]37
url (12)
- hxxp://104[.]208[.]155[.]37/a-r[.]m-4[.]ISIS;
- hxxp://104[.]208[.]155[.]37/a-r[.]m-5[.]ISIS;
- hxxp://104[.]208[.]155[.]37/a-r[.]m-6[.]ISIS;
- hxxp://104[.]208[.]155[.]37/a-r[.]m-7[.]ISIS;
- hxxp://104[.]208[.]155[.]37/i-5[.]8-6[.]ISIS;
- hxxp://104[.]208[.]155[.]37/m-6[.]8-k[.]ISIS;
- hxxp://104[.]208[.]155[.]37/m-i[.]p-s[.]ISIS;
- hxxp://104[.]208[.]155[.]37/m-p[.]s-l[.]ISIS;
- hxxp://104[.]208[.]155[.]37/p-p[.]c-[.]ISIS;
- hxxp://104[.]208[.]155[.]37/s-h[.]4-[.]ISIS;
- hxxp://104[.]208[.]155[.]37/x-3[.]2-[.]ISIS;
- hxxp://104[.]208[.]155[.]37/x-8[.]6-[.]ISIS;