General

  • Target

    sample

  • Size

    318KB

  • Sample

    230714-qxhsyaec46

  • MD5

    f9fed70bc6fc45963c2df36bbe878671

  • SHA1

    ed438defe81324a0cd334ff918ffd2ad67baf141

  • SHA256

    bad65480d4b645263f39ab76311339498ebe84af0cae8dfc2472a15c5f64c1a6

  • SHA512

    b0376190784db236dfce6cd9882ec606c2fce189732c58618081b16f93cfb7ed308abc7a5ee9b8eb01592124b956d26b557f19d4a56fea9b567098739c3cb16d

  • SSDEEP

    6144:sUzicKsfwzUy7Yiro9za0SwqZeNCPIhq+pteQVrLvmgQavC:DzicRfwzLinbCPIhq+pteQpvC

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      sample

    • Size

      318KB

    • MD5

      f9fed70bc6fc45963c2df36bbe878671

    • SHA1

      ed438defe81324a0cd334ff918ffd2ad67baf141

    • SHA256

      bad65480d4b645263f39ab76311339498ebe84af0cae8dfc2472a15c5f64c1a6

    • SHA512

      b0376190784db236dfce6cd9882ec606c2fce189732c58618081b16f93cfb7ed308abc7a5ee9b8eb01592124b956d26b557f19d4a56fea9b567098739c3cb16d

    • SSDEEP

      6144:sUzicKsfwzUy7Yiro9za0SwqZeNCPIhq+pteQVrLvmgQavC:DzicRfwzLinbCPIhq+pteQpvC

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks