Back to Malware Drops
fb435f531d7f018f5dc82baeda8e122611d99ce7547d5fb726d8f98147791ca1
MD5ede202e6ad0b927c8fd1a1bb80eb7f3b
SSDEEP384:fG4sGaHFHsv1TDKzHwMH9OHMhH75UbGcjpp:fSSv1TDKrwc9eMJ75Ubjpp
File Typetext/x-script
Size19.1 KB
Sources348
Downloads0
First SeenJul 13, 2022
Last SeenJul 17, 2022
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jul 13, 2022, 8:15:56 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 8:15:56 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 8:15:56 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 8:15:56 AMView attack session
- Dropped in this session (no command captured).Jul 13, 2022, 8:15:56 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (2)
- jira[.]onlypirate[.]top
- update[.]aegis[.]aliyun[.]com
ipv4 (6)
- 10[.]0[.]0[.]0
- 127[.]0[.]0[.]1
- 172[.]16[.]0[.]0
- 192[.]168[.]0[.]0
- 51[.]255[.]171[.]23
- 89[.]34[.]27[.]167
url (10)
- hxxp://$url/jira
- hxxp://$url/jira?confluence
- hxxp://89[.]34[.]27[.]167
- hxxp://89[.]34[.]27[.]167/jira
- hxxp://89[.]34[.]27[.]167/jira?confluence
- hxxp://jira[.]onlypirate[.]top
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/quartz_uninstall[.]sh||curl
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh
- hxxp://update[.]aegis[.]aliyun[.]com/download/uninstall[.]sh||curl