Back to Malware Drops
698995585cb9ffdaedd9766216d141932733e4f964430d3b10c36e0e4cdfeedf
MD5fb50a5b8bf26b3cba17583e33551d9bc
SSDEEP—
File Typetext/x-script
Size2.2 KB
Sources44
Downloads0
First SeenDec 27, 2022
Last SeenJan 2, 2023
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (8)
- a-r[.]m-4[.]Fourloko
- a-r[.]m-5[.]Fourloko
- a-r[.]m-6[.]Fourloko
- a-r[.]m-7[.]Fourloko
- i-5[.]8-6[.]Fourloko
- m-6[.]8-k[.]Fourloko
- m-i[.]p-s[.]Fourloko
- m-p[.]s-l[.]Fourloko
ipv4 (1)
- 195[.]58[.]39[.]207
url (12)
- hxxp://195[.]58[.]39[.]207/a-r[.]m-4[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/a-r[.]m-5[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/a-r[.]m-6[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/a-r[.]m-7[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/i-5[.]8-6[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/m-6[.]8-k[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/m-i[.]p-s[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/m-p[.]s-l[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/p-p[.]c-[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/s-h[.]4-[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/x-3[.]2-[.]Fourloko;
- hxxp://195[.]58[.]39[.]207/x-8[.]6-[.]Fourloko;