Back to Malware Drops
e197e4c47564e7e869029d767d11c33e3446ae68a6ed1a15fdb3608220161a8e
MD508bbe68370914ebb1cf704bac6bba241
SSDEEP—
File Typetext/x-script
Size2.9 KB
Sources20
Downloads0
First SeenJan 19, 2022
Last SeenJan 19, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jan 19, 2022, 6:07:01 AMView attack session
- Dropped in this session (no command captured).Jan 19, 2022, 6:07:01 AMView attack session
- Dropped in this session (no command captured).Jan 19, 2022, 6:07:01 AMView attack session
- Dropped in this session (no command captured).Jan 19, 2022, 6:07:01 AMView attack session
- Dropped in this session (no command captured).Jan 19, 2022, 6:07:01 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 179[.]43[.]187[.]99
url (15)
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]arc;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]arm;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]arm5;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]arm6;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]arm7;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]i486;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]i686;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]m68k;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]mips;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]mpsl;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]ppc;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]sh4;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]spc;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]x86;
- hxxp://179[.]43[.]187[.]99/1a9zxq/7ega[.]x86_64;