Sign In|Register
Back to Malware Drops

658e7cd5c9ecf5badebda06afced0bbfe23985f156adad03e593d01f5f5dfd6d

MD581d20a8afd6fa170deb4fdbbedb03eec
SSDEEP—
File Typetext/x-script
Size3.1 KB
Sources172
Downloads0
First SeenFeb 1, 2021
Last SeenFeb 2, 2021
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 194[.]87[.]139[.]159

url (20)

  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm4;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm4;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm5;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm5;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm6;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm6;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm7;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]arm7;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]m68k;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]m68k;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mips;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mips;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mpsl;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]mpsl;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]ppc;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]ppc;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]sh4;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]sh4;cat
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]x86;
  • hxxp://194[.]87[.]139[.]159/bns/gang123isgodloluaintgettingthesebinslikedammwtf[.]x86;cat