General

  • Target

    3c94204e.bin.zip

  • Size

    179KB

  • Sample

    230613-gxn6aafb55

  • MD5

    59a82155bb66473cbc94b4912da6bc9b

  • SHA1

    4c5a7598509c124adae6237bd412868bfd4098f3

  • SHA256

    2325249d2b4634afe7351754a777a5318138ea957b2fd03c54775f87bfedd909

  • SHA512

    1deb2e1899db860308f426ccd6dad600940e21592edf355d4d607afac52a496396ecd06d531af37c4180739a54b3c37ba0f08c90aebc0882f90c9998a975df91

  • SSDEEP

    3072:YYYH7tmxlqrXfcyh4OJQCNMu+LWAPyPIOp+WSmwrJnMdNIf+gaErTfDF9zAp:BYHRm2DcLOJQCNaPoJrIv9aAV92

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

zgclgdb.ru:8518

yekfhsh.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      3c94204e.bin

    • Size

      250KB

    • MD5

      5c55fc257423acd1ae6382d88b1ee306

    • SHA1

      153a3104fe52062844fed64c7a033d8378f7977f

    • SHA256

      1ec36fc1bb6bce36dd3a82304be237919ede3e6b790b7a248c340042353b5bc0

    • SHA512

      7cf5957892d1abf775284441dae7e2b4db23fe38e047c48ae9a2994c6b582a587fa83312e321c393f504b1bdfced8b6c34c7ca4098f51c7da4081be6c030f8c6

    • SSDEEP

      6144:whUsNSTyEDB1H9ys2rf2y5WhnLe4V6O3OS2:whUsOvDBhwBXWhnpl3S

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks