General

  • Target

    191c43ff2215a25c7448e52eea5972ed1bb25ca6c5f0935a17dd04f0c93dffa5

  • Size

    341KB

  • Sample

    230814-vqwhnsfg8y

  • MD5

    cda619f6db2749d113a19452f2ad5721

  • SHA1

    942b5f7a7f129cc2f36eec7ed1b07528fa66490f

  • SHA256

    191c43ff2215a25c7448e52eea5972ed1bb25ca6c5f0935a17dd04f0c93dffa5

  • SHA512

    791860a9eec524855eae3426d9165b497959e16d6be92db7905f563d32a614e62bf6ab5bf007a478feab3b4526297b1af99d261410f8e30f8a86ffb67c4a1eb9

  • SSDEEP

    6144:GwQqSygIGPB5nAORKLc/4/IVs8mqqWTKlSJv+2zsb:GwQqXGPfnrh4/IZfqWeXb

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      191c43ff2215a25c7448e52eea5972ed1bb25ca6c5f0935a17dd04f0c93dffa5

    • Size

      341KB

    • MD5

      cda619f6db2749d113a19452f2ad5721

    • SHA1

      942b5f7a7f129cc2f36eec7ed1b07528fa66490f

    • SHA256

      191c43ff2215a25c7448e52eea5972ed1bb25ca6c5f0935a17dd04f0c93dffa5

    • SHA512

      791860a9eec524855eae3426d9165b497959e16d6be92db7905f563d32a614e62bf6ab5bf007a478feab3b4526297b1af99d261410f8e30f8a86ffb67c4a1eb9

    • SSDEEP

      6144:GwQqSygIGPB5nAORKLc/4/IVs8mqqWTKlSJv+2zsb:GwQqXGPfnrh4/IZfqWeXb

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks