Back to Malware Drops
c627f36bd62d3c4f1dbe0b7d0c557f0c967334271b16bb766b9b3dd95580254a
MD58372e34486294c225704bb53d6198356
SSDEEP—
File Typetext/x-script
Size2.0 KB
Sources3
Downloads0
First SeenDec 15, 2018
Last SeenDec 15, 2018
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Dec 15, 2018, 12:51:16 AMView attack session
- Dropped in this session (no command captured).Dec 15, 2018, 12:51:16 AMView attack session
- Dropped in this session (no command captured).Dec 15, 2018, 12:51:16 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 185[.]234[.]217[.]9
url (20)
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm4;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm4;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm5;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm5;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm6;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm6;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm7;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]arm7;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]m68k;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]m68k;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]mips;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]mips;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]mpsl;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]mpsl;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]ppc;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]ppc;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]sh4;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]sh4;cat
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]x86;
- hxxp://185[.]234[.]217[.]9/bins/mortal[.]x86;cat