Back to Malware Drops
de51f1f37ac73e53b023dcef4b18481968fa581917bc80bfa64668df3e2e2db4
MD5b56003e10d1ae53b63b58c06d47c0b6e
SSDEEP—
File Typetext/x-script
Size1.5 KB
Sources56
Downloads0
First SeenApr 13, 2020
Last SeenApr 14, 2020
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Apr 13, 2020, 11:26:27 AMView attack session
- Dropped in this session (no command captured).Apr 13, 2020, 11:26:27 AMView attack session
- Dropped in this session (no command captured).Apr 13, 2020, 11:26:27 AMView attack session
- Dropped in this session (no command captured).Apr 13, 2020, 11:26:27 AMView attack session
- Dropped in this session (no command captured).Apr 13, 2020, 11:26:27 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 194[.]180[.]224[.]124
url (18)
- hxxp://194[.]180[.]224[.]124/a[.]arm;
- hxxp://194[.]180[.]224[.]124/a[.]arm5;
- hxxp://194[.]180[.]224[.]124/a[.]arm5;cat
- hxxp://194[.]180[.]224[.]124/a[.]arm7;
- hxxp://194[.]180[.]224[.]124/a[.]arm7;cat
- hxxp://194[.]180[.]224[.]124/a[.]arm;cat
- hxxp://194[.]180[.]224[.]124/a[.]m68k;
- hxxp://194[.]180[.]224[.]124/a[.]m68k;cat
- hxxp://194[.]180[.]224[.]124/a[.]mips;
- hxxp://194[.]180[.]224[.]124/a[.]mips;cat
- hxxp://194[.]180[.]224[.]124/a[.]mispel;
- hxxp://194[.]180[.]224[.]124/a[.]mispel;cat
- hxxp://194[.]180[.]224[.]124/a[.]sh4;
- hxxp://194[.]180[.]224[.]124/a[.]sh4;cat
- hxxp://194[.]180[.]224[.]124/a[.]spc;
- hxxp://194[.]180[.]224[.]124/a[.]spc;cat
- hxxp://194[.]180[.]224[.]124/a[.]x86;
- hxxp://194[.]180[.]224[.]124/a[.]x86;cat