General

  • Target

    6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32

  • Size

    341KB

  • Sample

    230814-vl3q7adg97

  • MD5

    745883407bb6296970af2fb650b04312

  • SHA1

    fc84f5d8e989929eef50379f7f62ed26662b4512

  • SHA256

    6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32

  • SHA512

    809640cdc63eefe406dc5f7cb1531536363d56801e4c940cc19d16aa5c67e3054f0b77aefe9812638c3842cc2ddef0e66da93c64c58f4fde49f0461237ac1aa1

  • SSDEEP

    6144:GwQqSygIGPB5nAORZLc/4/IVs8mqqWTKlSJv+2zsb:GwQqXGPfnro4/IZfqWeXb

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32

    • Size

      341KB

    • MD5

      745883407bb6296970af2fb650b04312

    • SHA1

      fc84f5d8e989929eef50379f7f62ed26662b4512

    • SHA256

      6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32

    • SHA512

      809640cdc63eefe406dc5f7cb1531536363d56801e4c940cc19d16aa5c67e3054f0b77aefe9812638c3842cc2ddef0e66da93c64c58f4fde49f0461237ac1aa1

    • SSDEEP

      6144:GwQqSygIGPB5nAORZLc/4/IVs8mqqWTKlSJv+2zsb:GwQqXGPfnro4/IZfqWeXb

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks