Back to Malware Drops
c40752c4decf04c067a11d7afe06425142ac0d575a03f198d80c04b932dc3375
MD58414cc41eac4200841037ae3ac1ff743
SSDEEP192:XyRCjS10wMI2ZqVIqKqxA51h4RRZPMIxf1h4RRvDqVIqKqxAsCYS:X0oS10bf1h4RR3f1h4RRsK
File Typetext/x-script
Size10.2 KB
Sources2
Downloads0
First SeenDec 14, 2024
Last SeenDec 14, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (1)
- bins[.]sh
ipv4 (1)
- 37[.]44[.]238[.]68
url (28)
- hxxp://37[.]44[.]238[.]68/bins/0RXA9ALXZRK72lwEHsUXTUuQINSNrt6hOz;
- hxxp://37[.]44[.]238[.]68/bins/0RXA9ALXZRK72lwEHsUXTUuQINSNrt6hOz;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/AJlgwvHbJsBwVUQT9Dzg9xcLhI6242TaA8;
- hxxp://37[.]44[.]238[.]68/bins/AJlgwvHbJsBwVUQT9Dzg9xcLhI6242TaA8;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/AnJdWymcHX2xOAhZIjuRCfnhwjEJ0yb90V;
- hxxp://37[.]44[.]238[.]68/bins/AnJdWymcHX2xOAhZIjuRCfnhwjEJ0yb90V;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/h942G4EMuvwWEUkeMUT6Z5JFp4fz80dkOP;
- hxxp://37[.]44[.]238[.]68/bins/h942G4EMuvwWEUkeMUT6Z5JFp4fz80dkOP;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/jKJAZFWdYtwiIh7Jz4qAXswKEu3SXJ4DuN;
- hxxp://37[.]44[.]238[.]68/bins/jKJAZFWdYtwiIh7Jz4qAXswKEu3SXJ4DuN;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/KI5BEUzMYra5q48LCpXOQt0ysvk6laLku3;
- hxxp://37[.]44[.]238[.]68/bins/KI5BEUzMYra5q48LCpXOQt0ysvk6laLku3;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/KlWNKVMzg0jevhVxtoMBWehE31O26ET4ww;
- hxxp://37[.]44[.]238[.]68/bins/KlWNKVMzg0jevhVxtoMBWehE31O26ET4ww;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/oD8Hl2n1qORQo0yVHQXnc5B3pGP7zl5sMg;
- hxxp://37[.]44[.]238[.]68/bins/oD8Hl2n1qORQo0yVHQXnc5B3pGP7zl5sMg;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/pJHzfDuK96Vj342Ks3QeSfnxV8b6Q7sHQQ;
- hxxp://37[.]44[.]238[.]68/bins/pJHzfDuK96Vj342Ks3QeSfnxV8b6Q7sHQQ;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/SAByKoiw1y4kTioi2lrsWKY9dW13cwFrrj;
- hxxp://37[.]44[.]238[.]68/bins/SAByKoiw1y4kTioi2lrsWKY9dW13cwFrrj;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/WU1EoS0Mi2LedPfB7DZvA8zh8h661MCP8z;
- hxxp://37[.]44[.]238[.]68/bins/WU1EoS0Mi2LedPfB7DZvA8zh8h661MCP8z;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/XOzmd2TMTJL1S9S7DkXiQVWvo6QntUEBvq;
- hxxp://37[.]44[.]238[.]68/bins/XOzmd2TMTJL1S9S7DkXiQVWvo6QntUEBvq;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/z2XoY416BDmccN57sg0Mr9sidTMGtHbZjK;
- hxxp://37[.]44[.]238[.]68/bins/z2XoY416BDmccN57sg0Mr9sidTMGtHbZjK;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/zWO7zeu6VmXEGkwlZbhkZich1H8iWZ7cCB;
- hxxp://37[.]44[.]238[.]68/bins/zWO7zeu6VmXEGkwlZbhkZich1H8iWZ7cCB;/bin/busybox