Sign In|Register
Back to Malware Drops

bb372c3dc758d6b16bb284e4fbdaafd0a3283e060132dd46dff60fbbe62095a8

MD594857874eac181fba6400a0dc5edab9e
SSDEEP—
File Typetext/x-script
Size2.4 KB
Sources49
Downloads0
First SeenNov 18, 2020
Last SeenNov 18, 2020
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 198[.]23[.]209[.]128

url (28)

  • hxxp://198[.]23[.]209[.]128/SBIDIOT/arm;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/arm6;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/arm6;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/arm7;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/arm7;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/arm;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/m68k;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/m68k;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/mips;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/mips;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/mpsl;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/mpsl;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/ppc;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/ppc;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/root;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/root;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/rtk;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/rtk;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/sh4;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/sh4;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/spc;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/spc;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/x86;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/x86;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/yarn;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/yarn;cat
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/zte;
  • hxxp://198[.]23[.]209[.]128/SBIDIOT/zte;cat