Back to Malware Drops
8f1d6031c6f49163d684e813bf0d633fa62c4534acba800cfc38a8f95c194fef
MD55ecd0706cb71a4d45d402741e39d2be5
SSDEEP—
File Typetext/x-script
Size1.6 KB
Sources12
Downloads0
First SeenApr 15, 2020
Last SeenApr 15, 2020
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Apr 15, 2020, 3:34:32 AMView attack session
- Dropped in this session (no command captured).Apr 15, 2020, 3:34:32 AMView attack session
- Dropped in this session (no command captured).Apr 15, 2020, 3:34:32 AMView attack session
- Dropped in this session (no command captured).Apr 15, 2020, 3:34:32 AMView attack session
- Dropped in this session (no command captured).Apr 15, 2020, 3:34:32 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 195[.]144[.]21[.]176
url (20)
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm4;
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm4;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm5;
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm5;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm6;
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm6;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm7;
- hxxp://195[.]144[.]21[.]176/d/xd[.]arm7;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]m68k;
- hxxp://195[.]144[.]21[.]176/d/xd[.]m68k;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]mips;
- hxxp://195[.]144[.]21[.]176/d/xd[.]mips;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]mpsl;
- hxxp://195[.]144[.]21[.]176/d/xd[.]mpsl;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]ppc;
- hxxp://195[.]144[.]21[.]176/d/xd[.]ppc;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]sh4;
- hxxp://195[.]144[.]21[.]176/d/xd[.]sh4;cat
- hxxp://195[.]144[.]21[.]176/d/xd[.]x86;
- hxxp://195[.]144[.]21[.]176/d/xd[.]x86;cat