Sign In|Register
Back to Malware Drops

f224ec4c3640a8f71e88eafce1a4a1bbeba59638be9dab5d10892d803af802c7

MD506bf6e24ed519c241e98c59fe7378c0b
SSDEEP—
File Typetext/x-script
Size2.1 KB
Sources6
Downloads0
First SeenOct 3, 2021
Last SeenOct 3, 2021
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

ipv4 (1)

  • 85[.]237[.]217[.]143

url (12)

  • hxxp://85[.]237[.]217[.]143/a-r[.]m-4[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/a-r[.]m-5[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/a-r[.]m-6[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/a-r[.]m-7[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/i-5[.]8-6[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/m-6[.]8-k[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/m-i[.]p-s[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/m-p[.]s-l[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/p-p[.]c-[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/s-h[.]4-[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/x-3[.]2-[.]SNOOPY;
  • hxxp://85[.]237[.]217[.]143/x-8[.]6-[.]SNOOPY;