Back to Malware Drops
f925a128771e9c185ad9d71484d2e7be920bca3b401bda850df0b7bc96a11660
MD570b211ae428678515e1b5aa35c026f00
SSDEEP96:E2OxOKbNUaCBokmRojHUPbEzT6ojHssaPbEzT6p2OxOKrOWFUakTdbZ7DQO:2cBokmRojHZjHjt
File Typetext/x-script
Size10.2 KB
Sources3
Downloads0
First SeenDec 15, 2024
Last SeenDec 15, 2024
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (1)
- bins[.]sh
ipv4 (1)
- 37[.]44[.]238[.]68
url (28)
- hxxp://37[.]44[.]238[.]68/bins/2Cv1alcee7M37BVuIeqX1Y4dXGuzidU3n5;
- hxxp://37[.]44[.]238[.]68/bins/2Cv1alcee7M37BVuIeqX1Y4dXGuzidU3n5;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/2R0L1x5hbUOXv7YlX1uua9QxtgTz9NPQ8Q;
- hxxp://37[.]44[.]238[.]68/bins/2R0L1x5hbUOXv7YlX1uua9QxtgTz9NPQ8Q;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/9qYj4LyWZKcaSH0Ve1PEwr9TVNE7qEhX6M;
- hxxp://37[.]44[.]238[.]68/bins/9qYj4LyWZKcaSH0Ve1PEwr9TVNE7qEhX6M;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/cfrPybeA37hqWmzghMRF6LAlgV2ExqTq0F;
- hxxp://37[.]44[.]238[.]68/bins/cfrPybeA37hqWmzghMRF6LAlgV2ExqTq0F;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/dFFTv5L5dozgwYuEZ03tQ1MfwGYdOpLLzM;
- hxxp://37[.]44[.]238[.]68/bins/dFFTv5L5dozgwYuEZ03tQ1MfwGYdOpLLzM;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/DxGiNsxv4nqvmZRkZXYHQJi73xAqJHeWk5;
- hxxp://37[.]44[.]238[.]68/bins/DxGiNsxv4nqvmZRkZXYHQJi73xAqJHeWk5;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/H4vvsLwoPxDFCVsFsXCJZiFqo997HmykLk;
- hxxp://37[.]44[.]238[.]68/bins/H4vvsLwoPxDFCVsFsXCJZiFqo997HmykLk;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/IoxZyZz3JLrLXKz281CWfsLyINEq5flB24;
- hxxp://37[.]44[.]238[.]68/bins/IoxZyZz3JLrLXKz281CWfsLyINEq5flB24;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/KEXogcVj83zs7Kviv34cMZqznTfgmjcpTP;
- hxxp://37[.]44[.]238[.]68/bins/KEXogcVj83zs7Kviv34cMZqznTfgmjcpTP;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/P95dwEUvQsDJtSXCotchcFwVprfzVCV3uH;
- hxxp://37[.]44[.]238[.]68/bins/P95dwEUvQsDJtSXCotchcFwVprfzVCV3uH;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/tElaarkOIK3uqWadmg7TqRf7R4cjFFf0bV;
- hxxp://37[.]44[.]238[.]68/bins/tElaarkOIK3uqWadmg7TqRf7R4cjFFf0bV;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/wA1M0soEVJ4nFiKM3mwkSeOMugi7Wk9W2T;
- hxxp://37[.]44[.]238[.]68/bins/wA1M0soEVJ4nFiKM3mwkSeOMugi7Wk9W2T;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/XSDTCwsHzj03X02q2RN8ZBbD4zGdheDd1U;
- hxxp://37[.]44[.]238[.]68/bins/XSDTCwsHzj03X02q2RN8ZBbD4zGdheDd1U;/bin/busybox
- hxxp://37[.]44[.]238[.]68/bins/XvWJXunvzx94pO4FvFCtiTBEutaAckNPDg;
- hxxp://37[.]44[.]238[.]68/bins/XvWJXunvzx94pO4FvFCtiTBEutaAckNPDg;/bin/busybox