Back to Malware Drops
a35c345ca46edab7ca2646a0b64b74e98c0d41ae59f17de7e2febe8ed72c8fd5
MD5ee89b8d626bf783d7ab1c2476e541b5c
SSDEEP—
File Typetext/x-script
Size1.9 KB
Sources114
Downloads0
First SeenJul 30, 2020
Last SeenJul 30, 2020
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jul 30, 2020, 4:29:32 PMView attack session
- Dropped in this session (no command captured).Jul 30, 2020, 4:29:32 PMView attack session
- Dropped in this session (no command captured).Jul 30, 2020, 4:29:32 PMView attack session
- Dropped in this session (no command captured).Jul 30, 2020, 4:29:32 PMView attack session
- Dropped in this session (no command captured).Jul 30, 2020, 4:29:32 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 185[.]172[.]111[.]195
url (20)
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm4;
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm4;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm5;
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm5;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm6;
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm6;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm7;
- hxxp://185[.]172[.]111[.]195/5858:uwu/arm7;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/m68k;
- hxxp://185[.]172[.]111[.]195/5858:uwu/m68k;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/mips;
- hxxp://185[.]172[.]111[.]195/5858:uwu/mips;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/mpsl;
- hxxp://185[.]172[.]111[.]195/5858:uwu/mpsl;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/ppc;
- hxxp://185[.]172[.]111[.]195/5858:uwu/ppc;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/sh4;
- hxxp://185[.]172[.]111[.]195/5858:uwu/sh4;cat
- hxxp://185[.]172[.]111[.]195/5858:uwu/x86;
- hxxp://185[.]172[.]111[.]195/5858:uwu/x86;cat