Back to Malware Drops
79fd29eaec8f5265e9fc7e3b81e062a53dcdddedeed48a405374ace83db8ae20
MD5455d32515168eababb737b61ec88fcd9
SSDEEP384:XdEHebVBNfm1BjfeWBJfitbqTOu0mdxeApKlDU1uRiGf/TS4moGTl15D6/g:Xd4Q3O1FGWLKVqT3rpKlDQuRiGfL15G/
File Typetext/x-script
Size13.2 KB
Sources2,123
Downloads0
First SeenAug 2, 2021
Last SeenAug 15, 2023
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Aug 2, 2021, 4:51:25 AMView attack session
- Dropped in this session (no command captured).Aug 2, 2021, 4:51:25 AMView attack session
- Dropped in this session (no command captured).Aug 2, 2021, 4:51:25 AMView attack session
- Dropped in this session (no command captured).Aug 2, 2021, 4:51:25 AMView attack session
- Dropped in this session (no command captured).Aug 2, 2021, 4:51:25 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (2)
- c3pool[.]com
- github[.]com
email (1)
- support@c3pool[.]com
url (4)
- hxxps://c3pool[.]com
- hxxps://github[.]com
- hxxps://github[.]com/xmrig/xmrig/releases/latest
- hxxps://raw[.]githubusercontent[.]com/C3Pool/xmrig_setup/master/xmrig[.]tar[.]gz