Sign In|Register
Back to Malware Drops

be9923b8f365740297bc8511359fec162b2c714f41c5f36244ce19ae5ce09ae0

MD55bdfecb6ba0f304588aec66dc3d0afdd
SSDEEP—
File Typetext/x-script
Size1.8 KB
Sources19
Downloads0
First SeenApr 22, 2021
Last SeenApr 22, 2021
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 51[.]79[.]44[.]155

url (20)

  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm4;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm4;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm5;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm5;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm6;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm6;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm7;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]arm7;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]m68k;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]m68k;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]mips;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]mips;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]mpsl;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]mpsl;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]ppc;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]ppc;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]sh4;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]sh4;cat
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]x86;
  • hxxp://51[.]79[.]44[.]155/AB4g5/Josho[.]x86;cat