Back to Malware Drops
e36f7e8f90d2736313b807c4cb3226dcb8d83abb9e123c9faca67aef61372289
MD5df52e9dcb512a429c388716f93b4188c
SSDEEP—
File Typetext/x-script
Size3.1 KB
Sources40
Downloads0
First SeenDec 28, 2021
Last SeenDec 29, 2021
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Dec 28, 2021, 8:16:35 PMView attack session
- Dropped in this session (no command captured).Dec 28, 2021, 8:16:35 PMView attack session
- Dropped in this session (no command captured).Dec 28, 2021, 8:16:35 PMView attack session
- Dropped in this session (no command captured).Dec 28, 2021, 8:16:35 PMView attack session
- Dropped in this session (no command captured).Dec 28, 2021, 8:16:35 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (2)
- 20[.]106[.]163[.]35
- 37[.]187[.]95[.]110
url (25)
- hxxp://20[.]106[.]163[.]35/cnrig
- hxxp://20[.]106[.]163[.]35/SBIDIOT/arm6[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/arm6[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/arm7[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/arm7[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/arm[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/arm[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/m68k[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/m68k[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/mips[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/mips[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/mpsl[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/mpsl[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/ppc[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/ppc[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/root[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/root[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/rtk[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/rtk[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/sh4[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/sh4[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/x86[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/x86[.]keen[.]onion[.]1337;cat
- hxxp://20[.]106[.]163[.]35/SBIDIOT/zte[.]keen[.]onion[.]1337;
- hxxp://20[.]106[.]163[.]35/SBIDIOT/zte[.]keen[.]onion[.]1337;cat