General

  • Target

    43e5903b.exe

  • Size

    318KB

  • Sample

    230326-n1lb5agd57

  • MD5

    273c80662a01016dee304339813354d8

  • SHA1

    35b4faaa4a98fa141d1388ac9b0adba0ac0d4a3d

  • SHA256

    6fcd36052b242bc33e90577e9a9cf5dc91bc7c5f3ad587b0d45ab4a7cb7b73b3

  • SHA512

    9c2649357f5e36cf9a468063d5b066858fe63b1a42a6934a32b23039850ad2cd176087dd2b3efee8ea1ef303632844befbeae9378ec225a9c725875c648f0c2c

  • SSDEEP

    6144:JLD5Gs375vaV1LEUR5gMv8c5WTMDjLhpuQxvG8u6PjBcHq8pXblFE:JLD5z9aPZ0dMfuQpLBc1TK

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      43e5903b.exe

    • Size

      318KB

    • MD5

      273c80662a01016dee304339813354d8

    • SHA1

      35b4faaa4a98fa141d1388ac9b0adba0ac0d4a3d

    • SHA256

      6fcd36052b242bc33e90577e9a9cf5dc91bc7c5f3ad587b0d45ab4a7cb7b73b3

    • SHA512

      9c2649357f5e36cf9a468063d5b066858fe63b1a42a6934a32b23039850ad2cd176087dd2b3efee8ea1ef303632844befbeae9378ec225a9c725875c648f0c2c

    • SSDEEP

      6144:JLD5Gs375vaV1LEUR5gMv8c5WTMDjLhpuQxvG8u6PjBcHq8pXblFE:JLD5z9aPZ0dMfuQpLBc1TK

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks