General

  • Target

    13dd0cac9f469fcc3efca37dab78498793dd8f40cda1ca770511966a709e6d17

  • Size

    392KB

  • Sample

    230814-vq136adh66

  • MD5

    52505779546aaf2ba8f67b75df119efd

  • SHA1

    119f4b183e6542c7883c2b456bbe745ee0c4e1e0

  • SHA256

    13dd0cac9f469fcc3efca37dab78498793dd8f40cda1ca770511966a709e6d17

  • SHA512

    6e3ab0f9df456b6280baf493f193a21996581386a567b269daeb53128974e737d2699f6d9d00b8be6c2d62c7e30f13d2c212df60107b0507d2e0c92062a8e1a6

  • SSDEEP

    6144:57vYTVJfP1XzxtFq5/kLvFr9TVH7tcaAHe8/vgdc3o:57KVJH1XHFNvFxBx7AHPoK

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ashfkwu.ru:9821

yekfhsh.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbx.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      13dd0cac9f469fcc3efca37dab78498793dd8f40cda1ca770511966a709e6d17

    • Size

      392KB

    • MD5

      52505779546aaf2ba8f67b75df119efd

    • SHA1

      119f4b183e6542c7883c2b456bbe745ee0c4e1e0

    • SHA256

      13dd0cac9f469fcc3efca37dab78498793dd8f40cda1ca770511966a709e6d17

    • SHA512

      6e3ab0f9df456b6280baf493f193a21996581386a567b269daeb53128974e737d2699f6d9d00b8be6c2d62c7e30f13d2c212df60107b0507d2e0c92062a8e1a6

    • SSDEEP

      6144:57vYTVJfP1XzxtFq5/kLvFr9TVH7tcaAHe8/vgdc3o:57KVJH1XHFNvFxBx7AHPoK

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks