Back to Malware Drops
a19e2c66ead95f847c31dd8f5704ac43b228bd2a1d864efdacc21e8040655f87
MD5a50f9014924374e1b7109ffe1dcfa555
SSDEEP—
File Typetext/x-script
Size2.0 KB
Sources15
Downloads0
First SeenDec 28, 2022
Last SeenDec 31, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (7)
- a-r[.]m-4[.]Fourloko
- a-r[.]m-5[.]Fourloko
- a-r[.]m-6[.]Fourloko
- i-5[.]8-6[.]Fourloko
- m-6[.]8-k[.]Fourloko
- m-i[.]p-s[.]Fourloko
- m-p[.]s-l[.]Fourloko
ipv4 (1)
- 195[.]58[.]39[.]18
url (11)
- hxxp://195[.]58[.]39[.]18/a-r[.]m-4[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/a-r[.]m-5[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/a-r[.]m-6[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/i-5[.]8-6[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/m-6[.]8-k[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/m-i[.]p-s[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/m-p[.]s-l[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/p-p[.]c-[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/s-h[.]4-[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/x-3[.]2-[.]Fourloko;
- hxxp://195[.]58[.]39[.]18/x-8[.]6-[.]Fourloko;