Back to Malware Drops
a45bf4aa6629ef67e0a3511c8abed17a2c7ff9df3ad180102150edfe9a961830
MD54d4c03ca31f3116d8adc912a12506d33
SSDEEP384:UIxCsJEHe4XDp2fv6MR78JSZ9WWaM0fd43+yZzB3lp:0sJge4XDp2fv5R78JSWW/oRy1B3D
File Typetext/x-script
Size27.7 KB
Sources992
Downloads0
First SeenOct 27, 2024
Last SeenDec 27, 2025
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (11)
- ADM[.]pl
- atrix-team[.]org
- cmd[.]exe
- Conback[.]pl
- gsm[.]ftp[.]sh
- idents[.]php
- names[.]php
- names[.]txt
- websurvey[.]burstmedia[.]com
- www[.]atrix-team[.]org
- www[.]minpop[.]com
email (1)
- oldwolf@atrix-team[.]org
url (4)
- hxxp://([^/:
- hxxp://websurvey[.]burstmedia[.]com/names[.]txt
- hxxp://www[.]minpop[.]com/sk12pack/idents[.]php
- hxxp://www[.]minpop[.]com/sk12pack/names[.]php