Back to Malware Drops
afafc140f5b9bd90885bd429fcbdb99934e19d3037d83fccff1f82c5030f13c4
MD5298bdd1d517b03f3b812be145e8f7356
SSDEEP192:k/PXjybDjbt1iVhTWGXfWfrUI8tEcc8dPXjybDjt1iVhhXfWfroI8tEca:kGbt1iVhTWGXfWfrUI8tEcc80t1iVhhg
File Typetext/x-script
Size10.2 KB
Sources2
Downloads0
First SeenDec 16, 2024
Last SeenDec 16, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (1)
- bins[.]sh
ipv4 (1)
- 37[.]44[.]238[.]68
url (28)
- hxxp://37[.]44[.]238[.]68/bins/58VyTR3qlDHNUHHmaII8J5Y5hoaAhLhAxW;
- hxxp://37[.]44[.]238[.]68/bins/58VyTR3qlDHNUHHmaII8J5Y5hoaAhLhAxW;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/9MRJtoMtqk3fB2kMNI7RNkm65HyRAmDJV9;
- hxxp://37[.]44[.]238[.]68/bins/9MRJtoMtqk3fB2kMNI7RNkm65HyRAmDJV9;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/Bfi32gOb2wZofKQIz2cYzBmYeJ2lFTQ8dc;
- hxxp://37[.]44[.]238[.]68/bins/Bfi32gOb2wZofKQIz2cYzBmYeJ2lFTQ8dc;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/EOSa68Azxt8GY2seC8vzZaU3DbF0Gkbyld;
- hxxp://37[.]44[.]238[.]68/bins/EOSa68Azxt8GY2seC8vzZaU3DbF0Gkbyld;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/FVPt0WaUwV75fr32Q5VmswRRrlDuU8pfec;
- hxxp://37[.]44[.]238[.]68/bins/FVPt0WaUwV75fr32Q5VmswRRrlDuU8pfec;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/invdC6sWCD1ifNjd3dgizUFxECc5ofTqSd;
- hxxp://37[.]44[.]238[.]68/bins/invdC6sWCD1ifNjd3dgizUFxECc5ofTqSd;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/jqfiglV5TFWetkZBZwo8IaOIrusyUqoMka;
- hxxp://37[.]44[.]238[.]68/bins/jqfiglV5TFWetkZBZwo8IaOIrusyUqoMka;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/L0i7OtuBFUV8SPsy6lsxsBM5YYE8uU97hy;
- hxxp://37[.]44[.]238[.]68/bins/L0i7OtuBFUV8SPsy6lsxsBM5YYE8uU97hy;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/pEntBtofDk4sEmVRAaXvzcrAinWjfdnuvx;
- hxxp://37[.]44[.]238[.]68/bins/pEntBtofDk4sEmVRAaXvzcrAinWjfdnuvx;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/qywjpO3nhoeanS2mSmYHQrx1kJEXV5byj2;
- hxxp://37[.]44[.]238[.]68/bins/qywjpO3nhoeanS2mSmYHQrx1kJEXV5byj2;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/wcfMDT3WzIJxQR7ccld6Lf9J3XDHwFwMKV;
- hxxp://37[.]44[.]238[.]68/bins/wcfMDT3WzIJxQR7ccld6Lf9J3XDHwFwMKV;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/XklPFT7jqVapLwIPRhdbkll7heYEejZ8Qn;
- hxxp://37[.]44[.]238[.]68/bins/XklPFT7jqVapLwIPRhdbkll7heYEejZ8Qn;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/yGQdzsyaBrUSgHdX0xHMR0yuT1R1JU51i0;
- hxxp://37[.]44[.]238[.]68/bins/yGQdzsyaBrUSgHdX0xHMR0yuT1R1JU51i0;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/YZThaDmNK85agfsKuFCXOwyI3UcaGHkEn9;
- hxxp://37[.]44[.]238[.]68/bins/YZThaDmNK85agfsKuFCXOwyI3UcaGHkEn9;/bin/busybox