Back to Malware Drops
f183565c24243367934e2cdad7226c7d56d3f50c44a5640a17fdae9d81e18623
MD5a5be823f56aac4cd8e020873d9dc66d4
SSDEEP—
File Typetext/x-script
Size2.0 KB
Sources11
Downloads0
First SeenDec 31, 2022
Last SeenDec 31, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (7)
- a-r[.]m-4[.]Fourloko
- a-r[.]m-5[.]Fourloko
- a-r[.]m-6[.]Fourloko
- i-5[.]8-6[.]Fourloko
- m-6[.]8-k[.]Fourloko
- m-i[.]p-s[.]Fourloko
- m-p[.]s-l[.]Fourloko
ipv4 (1)
- 195[.]58[.]39[.]206
url (11)
- hxxp://195[.]58[.]39[.]206/a-r[.]m-4[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/a-r[.]m-5[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/a-r[.]m-6[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/i-5[.]8-6[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/m-6[.]8-k[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/m-i[.]p-s[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/m-p[.]s-l[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/p-p[.]c-[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/s-h[.]4-[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/x-3[.]2-[.]Fourloko;
- hxxp://195[.]58[.]39[.]206/x-8[.]6-[.]Fourloko;