Back to Malware Drops
947f23226f0c2dfcbef1f9aa5ce6518f9c23f89dd715eba260bdd972778ca73a
MD5fce8531aff70673d987d0d6765a72484
SSDEEP384:fGosGrHFHsv1TDKzHwMH9OHMhH75UbGcjpp:f3Sv1TDKrwc9eMJ75Ubjpp
File Typetext/x-script
Size19.1 KB
Sources110
Downloads0
First SeenJul 13, 2022
Last SeenJul 13, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jul 13, 2022, 1:23:18 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 1:23:18 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 1:23:18 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 1:23:18 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 1:23:18 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (2)
- jira[.]letmaker[.]top
- update[.]aegis[.]aliyun[.]com
ipv4 (6)
- 10[.]0[.]0[.]0
- 127[.]0[.]0[.]1
- 172[.]16[.]0[.]0
- 192[.]168[.]0[.]0
- 51[.]255[.]171[.]23
- 89[.]34[.]27[.]167
url (10)
- hxxp://$url/jira
- hxxp://$url/jira?confluence
- hxxp://89[.]34[.]27[.]167
- hxxp://89[.]34[.]27[.]167/jira
- hxxp://89[.]34[.]27[.]167/jira?confluence
- hxxp://jira[.]letmaker[.]top
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh||curl
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh||curl