Back to Malware Drops
b9354eb880dd5212133ba04abad6e7b6c0db99c9830875abad5e978e47b8358b
MD560db560bb65b1becb630c7a6cbdf88a4
SSDEEP—
File Typetext/x-script
Size1.9 KB
Sources42
Downloads0
First SeenApr 29, 2022
Last SeenApr 29, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Apr 29, 2022, 10:14:02 PMView attack session
- Dropped in this session (no command captured).Apr 29, 2022, 10:14:02 PMView attack session
- Dropped in this session (no command captured).Apr 29, 2022, 10:14:02 PMView attack session
- Dropped in this session (no command captured).Apr 29, 2022, 10:14:02 PMView attack session
- Dropped in this session (no command captured).Apr 29, 2022, 10:14:02 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 45[.]148[.]123[.]58
url (12)
- hxxp://45[.]148[.]123[.]58/a-r[.]m-4[.]ISIS;
- hxxp://45[.]148[.]123[.]58/a-r[.]m-5[.]ISIS;
- hxxp://45[.]148[.]123[.]58/a-r[.]m-6[.]ISIS;
- hxxp://45[.]148[.]123[.]58/a-r[.]m-7[.]ISIS;
- hxxp://45[.]148[.]123[.]58/i-5[.]8-6[.]ISIS;
- hxxp://45[.]148[.]123[.]58/m-6[.]8-k[.]ISIS;
- hxxp://45[.]148[.]123[.]58/m-i[.]p-s[.]ISIS;
- hxxp://45[.]148[.]123[.]58/m-p[.]s-l[.]ISIS;
- hxxp://45[.]148[.]123[.]58/p-p[.]c-[.]ISIS;
- hxxp://45[.]148[.]123[.]58/s-h[.]4-[.]ISIS;
- hxxp://45[.]148[.]123[.]58/x-3[.]2-[.]ISIS;
- hxxp://45[.]148[.]123[.]58/x-8[.]6-[.]ISIS;