General

  • Target

    mylobot_latest.zip

  • Size

    75KB

  • Sample

    230808-dset9sbh2s

  • MD5

    dfb76d597f60248f14a75dd07eeefdc7

  • SHA1

    9354da87bdda41ccce1cbd38dedc6f253d8fb375

  • SHA256

    f9f42884c2ab1389bfd72744d0966d90dd9e7b2678feed102962dc217fc4d772

  • SHA512

    8d66359eaea5195c5b6f717099a2d62516dd79f54ad7903d804a7ef8c1e2a0b7acc9a23a32c489841b199bc54d163a622792679894d6a11654e7e58836cfe205

  • SSDEEP

    1536:zef4O/dNNgC+a76RQzBySBA9QhxOKKk8nzF4uSDGt98FxcOXMLmf0HiT:zQ4O/dNNgkIQzAS2yKk8zFnsg8FxX0CT

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Targets

    • Target

      013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c

    • Size

      212KB

    • MD5

      c14dcdce694dafc6a81971f9cea546cf

    • SHA1

      7942afd9026704780cbc98f8ea4d66f7cf790b09

    • SHA256

      013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c

    • SHA512

      1f2939723f743d3183163acfd434e5735e7d8d3bedbc1c4e4391ce74c0fd5c682f063b1c7738993e6d651f3d1a5592bc2af347cbd63bc73e1e82c36c5e7e8ac4

    • SSDEEP

      3072:Glo6aFcGrvov59zOLgR7fUn5VVccPnWfFzHpUeSS:L6aLov516gs32Wej

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks