Back to Malware Drops
61ed3c1840e69aac6983aa3a84d89cb9d1516ac41d2c96c60a4b006819c4355e
MD5330bc11b709fdebd29a7ef01302ca5d7
SSDEEP—
File Typetext/x-script
Size2.1 KB
Sources79
Downloads0
First SeenAug 25, 2020
Last SeenAug 30, 2020
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Aug 25, 2020, 10:33:23 PMView attack session
- Dropped in this session (no command captured).Aug 25, 2020, 10:33:23 PMView attack session
- Dropped in this session (no command captured).Aug 25, 2020, 10:33:23 PMView attack session
- Dropped in this session (no command captured).Aug 25, 2020, 10:33:23 PMView attack session
- Dropped in this session (no command captured).Aug 25, 2020, 10:33:23 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 172[.]245[.]112[.]72
url (12)
- hxxp://172[.]245[.]112[.]72/a-r[.]m-4[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/a-r[.]m-5[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/a-r[.]m-6[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/a-r[.]m-7[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/i-5[.]8-6[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/m-6[.]8-k[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/m-i[.]p-s[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/m-p[.]s-l[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/p-p[.]c-[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/s-h[.]4-[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/x-3[.]2-[.]SNOOPY;
- hxxp://172[.]245[.]112[.]72/x-8[.]6-[.]SNOOPY;