Early Virus Total Catch
When you aren’t quite first into Virus Total, but not far off, and the malware author who hard-coded an IP address is still using that IP :-)
Virus Total says:
First Submission 2018-04-03 00:00:53
Last Submission 2018-04-03 22:07:38
Last Analysis 2018-04-03 22:07:38
Hopefully the IP address owner got a dozen emails already, they’re a cloud provider.