General

  • Target

    1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae

  • Size

    316KB

  • Sample

    230814-vqqbnadh63

  • MD5

    b73f3f8f53bb20019e43d989295c6f0f

  • SHA1

    8a8a9a3018b956cffeab92e2c586acdb11bd064e

  • SHA256

    1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae

  • SHA512

    3a05827d9812b7e70262e6ce09e0c7408db2add0d84f0dcbfcd62ba07d977bf3d4adfc8c9fefc036ab121b7103bcc249461f7dd13afde86798399f699f08325b

  • SSDEEP

    6144:o2AXMEuLy5czapUCkzJrWqQxXVf1zD5+o2Lv2J:oOEuLMIzlr2Vf1/5D6+J

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae

    • Size

      316KB

    • MD5

      b73f3f8f53bb20019e43d989295c6f0f

    • SHA1

      8a8a9a3018b956cffeab92e2c586acdb11bd064e

    • SHA256

      1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae

    • SHA512

      3a05827d9812b7e70262e6ce09e0c7408db2add0d84f0dcbfcd62ba07d977bf3d4adfc8c9fefc036ab121b7103bcc249461f7dd13afde86798399f699f08325b

    • SSDEEP

      6144:o2AXMEuLy5czapUCkzJrWqQxXVf1zD5+o2Lv2J:oOEuLMIzlr2Vf1/5D6+J

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks