General

  • Target

    9623e079d6592eeb170ec8b81f24614d3dbab4f55f1f233c1338033c0c5b4ded

  • Size

    191KB

  • Sample

    230905-ldh75seg35

  • MD5

    5f278456ba0ad90d9c217fdc9383e4fc

  • SHA1

    02936536fc3457ac98319bf79e4fcbadfccb1d70

  • SHA256

    9623e079d6592eeb170ec8b81f24614d3dbab4f55f1f233c1338033c0c5b4ded

  • SHA512

    d39056196939e1f8eb772f1ae80ce0a7768f39bd412652ae1eb672d7246594eac8ad32496a9bb07db6d490e528cc4fe1f4ee3fddb30f2ad74e4daa8bf24c30e8

  • SSDEEP

    3072:snTm3a9yPPZTlyC9Kjf5qbGFqMRLAHvY3TF29B8gn4CLgla8rYCmH:snTm3UUKjfYSF1AHCTF29B8j4ia8rPE

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      {8392f6ba-c277-0678-eaee-9bacf848c80c}/1b4e8f9c-0d4f-f5b6-ae12-0288688bd76c.exe

    • Size

      365KB

    • MD5

      af181c80feb0de1ee2731f832c9b4841

    • SHA1

      27881041b17ab278b04538906f240eb6363243b1

    • SHA256

      ffcbf891fa7f1a2e21d6ae2e0dde14423eb05fb2949bda7a0879efff17eba77f

    • SHA512

      87a7a6825b2baadac33d468160b45eaf2e7a9b9b768cae60245dc35dcc8f31245253c94ff18950174f9ac397e3980d293633bb81badf8a307dfcf3c6a7ac35ee

    • SSDEEP

      6144:/MVZaXRwY3M1tEPCFk1PmmHJkUxZDwDRN+SOz:/MVZaXCY3u66KxJwtN+SY

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks