Sign In|Register
Back to Malware Drops

c52a85eefa81d098bff16bfc646017a12bfab7ecb77caf2b35feb4ab2fc902e4

MD5e8b853170108dcd06e6ef1d92fe5a3c9
SSDEEP—
File Typetext/x-script
Size2.0 KB
Sources43
Downloads0
First SeenApr 8, 2021
Last SeenApr 8, 2021
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 88[.]218[.]17[.]110

url (20)

  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm4;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm4;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm5;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm5;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm6;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm6;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm7;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]arm7;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]m68k;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]m68k;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]mips;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]mips;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]mpsl;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]mpsl;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]ppc;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]ppc;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]sh4;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]sh4;cat
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]x86;
  • hxxp://88[.]218[.]17[.]110/bins/Oblivion121[.]x86;cat