Back to Malware Drops
b2b821ffae320a02b65b50c362082f0bedd25692623b669dba6f0999a2d2410c
MD531a72309dd7236ff0e740f1c39567013
SSDEEP192:vV4jwxlqimtWG3iwoWUb3xlWimtWGewoug:vV4jwxlmiwopb3xlxwoz
File Typetext/x-script
Size10.2 KB
Sources7
Downloads0
First SeenDec 13, 2024
Last SeenDec 13, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (1)
- bins[.]sh
ipv4 (1)
- 37[.]44[.]238[.]68
url (28)
- hxxp://37[.]44[.]238[.]68/bins/cEF2JvfRkFvkiZ2R6fQKWXmzUDWoEYztNy;
- hxxp://37[.]44[.]238[.]68/bins/cEF2JvfRkFvkiZ2R6fQKWXmzUDWoEYztNy;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/FfF46u0TpZOdAsVr6xkIxSqj3LqvSyE5yn;
- hxxp://37[.]44[.]238[.]68/bins/FfF46u0TpZOdAsVr6xkIxSqj3LqvSyE5yn;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/GilCi25cNugQSbZ7PBQ8dMcUsXV3jsgVbJ;
- hxxp://37[.]44[.]238[.]68/bins/GilCi25cNugQSbZ7PBQ8dMcUsXV3jsgVbJ;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/lKt8pdVF8q5nJiGLuGf0m3KYLWSzCnbYSC;
- hxxp://37[.]44[.]238[.]68/bins/lKt8pdVF8q5nJiGLuGf0m3KYLWSzCnbYSC;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/LODzb0yJMI3Kos2xdoDNVZzNovTm4ZJISl;
- hxxp://37[.]44[.]238[.]68/bins/LODzb0yJMI3Kos2xdoDNVZzNovTm4ZJISl;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/mWDTftzOOV81E6luLw5Ch4E2fjPLwmm5UB;
- hxxp://37[.]44[.]238[.]68/bins/mWDTftzOOV81E6luLw5Ch4E2fjPLwmm5UB;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/R5ZczICuPJdaHXMMH0L6Dr9sLKeDw0ezKS;
- hxxp://37[.]44[.]238[.]68/bins/R5ZczICuPJdaHXMMH0L6Dr9sLKeDw0ezKS;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/rE6GI40R8V0j8eZXbIuTb1iSzkX8avpjhs;
- hxxp://37[.]44[.]238[.]68/bins/rE6GI40R8V0j8eZXbIuTb1iSzkX8avpjhs;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/RWAfs3VMWVwNTPKt7I3lbZbfw76cEvBfig;
- hxxp://37[.]44[.]238[.]68/bins/RWAfs3VMWVwNTPKt7I3lbZbfw76cEvBfig;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/tXVhbKRaD7wIzcrfirCsPxK0jcughpzQPL;
- hxxp://37[.]44[.]238[.]68/bins/tXVhbKRaD7wIzcrfirCsPxK0jcughpzQPL;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/v6vDAKpsqn10gjIjeerIYyGPV6UQJdZf8F;
- hxxp://37[.]44[.]238[.]68/bins/v6vDAKpsqn10gjIjeerIYyGPV6UQJdZf8F;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/x5laTIhFWvPreC76mtdZCNegc4PdmAzOyM;
- hxxp://37[.]44[.]238[.]68/bins/x5laTIhFWvPreC76mtdZCNegc4PdmAzOyM;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/ySUpJDNchsw4BiuccBWmJF4LORotCAQ8QA;
- hxxp://37[.]44[.]238[.]68/bins/ySUpJDNchsw4BiuccBWmJF4LORotCAQ8QA;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/z2PbOU4xBarusjaKMq1ocegx78l8FFkEhD;
- hxxp://37[.]44[.]238[.]68/bins/z2PbOU4xBarusjaKMq1ocegx78l8FFkEhD;/bin/busybox