Back to Malware Drops
fae1c9a6cafcdf299f86a78ffed4e371b82b05b3f09eb933d866ab3244d0c704
MD509bddc28576dc82a4f9e2b350d617fc6
SSDEEP—
File Typetext/x-script
Size1.8 KB
Sources13
Downloads0
First SeenJul 28, 2019
Last SeenOct 30, 2019
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jul 28, 2019, 11:12:18 AMView attack session
- Dropped in this session (no command captured).Jul 28, 2019, 11:12:18 AMView attack session
- Dropped in this session (no command captured).Jul 28, 2019, 11:12:18 AMView attack session
- Dropped in this session (no command captured).Jul 28, 2019, 11:12:18 AMView attack session
- Dropped in this session (no command captured).Jul 28, 2019, 11:12:18 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
ipv4 (1)
- 91[.]209[.]70[.]174
url (26)
- hxxp://91[.]209[.]70[.]174/Corona[.]arm4;
- hxxp://91[.]209[.]70[.]174/Corona[.]arm4;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]arm5;
- hxxp://91[.]209[.]70[.]174/Corona[.]arm5;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]arm6;
- hxxp://91[.]209[.]70[.]174/Corona[.]arm6;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]arm7;
- hxxp://91[.]209[.]70[.]174/Corona[.]arm7;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]i586;
- hxxp://91[.]209[.]70[.]174/Corona[.]i586;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]i686;
- hxxp://91[.]209[.]70[.]174/Corona[.]i686;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]m68k;
- hxxp://91[.]209[.]70[.]174/Corona[.]m68k;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]mips;
- hxxp://91[.]209[.]70[.]174/Corona[.]mips;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]mipsel;
- hxxp://91[.]209[.]70[.]174/Corona[.]mipsel;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]ppc;
- hxxp://91[.]209[.]70[.]174/Corona[.]ppc;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]sh4;
- hxxp://91[.]209[.]70[.]174/Corona[.]sh4;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]sparc;
- hxxp://91[.]209[.]70[.]174/Corona[.]sparc;cat
- hxxp://91[.]209[.]70[.]174/Corona[.]x86_64;
- hxxp://91[.]209[.]70[.]174/Corona[.]x86_64;cat