Back to Malware Drops
6d8dd204f569ede74579e16b98043f414a7361b608cff76503e54c5d5f6d7b3d
MD51830a9896bc9ec625b6794d524fb63d9
SSDEEP—
File Typetext/x-script
Size1.6 KB
Sources8
Downloads0
First SeenSep 7, 2022
Last SeenSep 7, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Sep 7, 2022, 12:15:43 AMView attack session
- Dropped in this session (no command captured).Sep 7, 2022, 12:15:43 AMView attack session
- Dropped in this session (no command captured).Sep 7, 2022, 12:15:43 AMView attack session
- Dropped in this session (no command captured).Sep 7, 2022, 12:15:43 AMView attack session
- Dropped in this session (no command captured).Sep 7, 2022, 12:15:43 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 185[.]216[.]71[.]116
url (20)
- hxxp://185[.]216[.]71[.]116/bins/arm4;
- hxxp://185[.]216[.]71[.]116/bins/arm4;cat
- hxxp://185[.]216[.]71[.]116/bins/arm5;
- hxxp://185[.]216[.]71[.]116/bins/arm5;cat
- hxxp://185[.]216[.]71[.]116/bins/arm6;
- hxxp://185[.]216[.]71[.]116/bins/arm6;cat
- hxxp://185[.]216[.]71[.]116/bins/arm7;
- hxxp://185[.]216[.]71[.]116/bins/arm7;cat
- hxxp://185[.]216[.]71[.]116/bins/m68k;
- hxxp://185[.]216[.]71[.]116/bins/m68k;cat
- hxxp://185[.]216[.]71[.]116/bins/mips;
- hxxp://185[.]216[.]71[.]116/bins/mips;cat
- hxxp://185[.]216[.]71[.]116/bins/mpsl;
- hxxp://185[.]216[.]71[.]116/bins/mpsl;cat
- hxxp://185[.]216[.]71[.]116/bins/ppc;
- hxxp://185[.]216[.]71[.]116/bins/ppc;cat
- hxxp://185[.]216[.]71[.]116/bins/sh4;
- hxxp://185[.]216[.]71[.]116/bins/sh4;cat
- hxxp://185[.]216[.]71[.]116/bins/x86;
- hxxp://185[.]216[.]71[.]116/bins/x86;cat