Back to Malware Drops
8bb563713e28849b0ec00ae84f55a3db4a405c1844433de5fc3db4e22f1d1843
MD5e68bdc7c5833d6fb117c4b1ea967a719
SSDEEP—
File Typetext/x-script
Size2.4 KB
Sources6
Downloads0
First SeenNov 10, 2020
Last SeenNov 10, 2020
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Nov 10, 2020, 4:07:42 AMView attack session
- Dropped in this session (no command captured).Nov 10, 2020, 4:07:42 AMView attack session
- Dropped in this session (no command captured).Nov 10, 2020, 4:07:42 AMView attack session
- Dropped in this session (no command captured).Nov 10, 2020, 4:07:42 AMView attack session
- Dropped in this session (no command captured).Nov 10, 2020, 4:07:42 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 185[.]132[.]53[.]101
url (28)
- hxxp://185[.]132[.]53[.]101/SBIDIOT/arm;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/arm6;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/arm6;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/arm7;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/arm7;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/arm;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/m68k;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/m68k;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/mips;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/mips;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/mpsl;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/mpsl;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/ppc;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/ppc;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/root;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/root;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/rtk;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/rtk;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/sh4;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/sh4;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/spc;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/spc;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/x86;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/x86;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/yarn;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/yarn;cat
- hxxp://185[.]132[.]53[.]101/SBIDIOT/zte;
- hxxp://185[.]132[.]53[.]101/SBIDIOT/zte;cat