Back to Malware Drops
e3ffabc5ef9ea3374538818f0c80a0abf7c4199eb2e1be0f782444385c2e3ce5
MD5e96a5b1134182f05ec28feaf0d7b41db
SSDEEP192:qnPWPz4arYEn6p0/a4iDz07HYkrDz07HJ+nPWPzJVYEn6p0o:UcYEn6p0/a4GZYEn6p0o
File Typetext/x-script
Size10.2 KB
Sources7
Downloads0
First SeenDec 13, 2024
Last SeenDec 13, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (1)
- bins[.]sh
ipv4 (1)
- 37[.]44[.]238[.]68
url (28)
- hxxp://37[.]44[.]238[.]68/bins/17rLh5kowkRjkL7IIpG65ZUig2iwP6JdRx;
- hxxp://37[.]44[.]238[.]68/bins/17rLh5kowkRjkL7IIpG65ZUig2iwP6JdRx;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/2mZrBxJgCe7FMwAqaFUotXxcn8bQMwywbh;
- hxxp://37[.]44[.]238[.]68/bins/2mZrBxJgCe7FMwAqaFUotXxcn8bQMwywbh;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/4YEEo2mHY9k2iH8pe1zsgnmiTF0M0TkGQ7;
- hxxp://37[.]44[.]238[.]68/bins/4YEEo2mHY9k2iH8pe1zsgnmiTF0M0TkGQ7;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/7BcD8xtizIQMSMtrQhTynhRB5ct7UmjKUs;
- hxxp://37[.]44[.]238[.]68/bins/7BcD8xtizIQMSMtrQhTynhRB5ct7UmjKUs;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/E302SThpJBx8cHfOb99IhTPsdlQDPyBKcA;
- hxxp://37[.]44[.]238[.]68/bins/E302SThpJBx8cHfOb99IhTPsdlQDPyBKcA;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/G2FLxgoZrkvJrnwB0cF1meqE7nx62HmL3O;
- hxxp://37[.]44[.]238[.]68/bins/G2FLxgoZrkvJrnwB0cF1meqE7nx62HmL3O;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/IGxsrj5eB3u3UH8f7d9mby2JmOAdXvizFX;
- hxxp://37[.]44[.]238[.]68/bins/IGxsrj5eB3u3UH8f7d9mby2JmOAdXvizFX;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/JvgSrGavatv6ho5VmktNPyEHoI2doOAoUU;
- hxxp://37[.]44[.]238[.]68/bins/JvgSrGavatv6ho5VmktNPyEHoI2doOAoUU;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/kwwdskEDcQrG5bagh8jI71WcszzXwsNv9z;
- hxxp://37[.]44[.]238[.]68/bins/kwwdskEDcQrG5bagh8jI71WcszzXwsNv9z;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/LGLNPDitNSTz5A9WNfFZFHf77313C2Zdq5;
- hxxp://37[.]44[.]238[.]68/bins/LGLNPDitNSTz5A9WNfFZFHf77313C2Zdq5;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/pTYkc2POWvPJTD4l6VJkAmeWJxomqp65DX;
- hxxp://37[.]44[.]238[.]68/bins/pTYkc2POWvPJTD4l6VJkAmeWJxomqp65DX;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/qh0fBLspkjSwNvtMnkMwizHOYenteldzDX;
- hxxp://37[.]44[.]238[.]68/bins/qh0fBLspkjSwNvtMnkMwizHOYenteldzDX;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/VRGv368zTdJmyIXPfMyUEG0sY4Gf0tKUM5;
- hxxp://37[.]44[.]238[.]68/bins/VRGv368zTdJmyIXPfMyUEG0sY4Gf0tKUM5;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/WJ1EjOftu052C4IqmOvR1UbDSz9Urj5PVF;
- hxxp://37[.]44[.]238[.]68/bins/WJ1EjOftu052C4IqmOvR1UbDSz9Urj5PVF;/bin/busybox