General

  • Target

    NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

  • Size

    724KB

  • Sample

    231013-s7vxcsdc32

  • MD5

    78250987584b2394fb1590f587bc9f6f

  • SHA1

    18290c77501235f5f7b8f5728e076aef6b7fd567

  • SHA256

    f865e7eddcdd476f8e2f6baa3ff80d2309ca04934ee21127399c392b1913b0d1

  • SHA512

    74cd48a6abfdf4014c1330445cab16fd36c9e7c9c2eb6b5ab262950bcc49091ab45a6fc022a634ee8628d6991dc7b9d48d45878d89074418914e5ac8231e6278

  • SSDEEP

    12288:9Mxx8WihpUDm/7DIuY0IlkNzbGKoS54TCCWvFD/cfUV:C8WinWm/7UuY0IlkNz6mkCC4Z/cS

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

    • Size

      724KB

    • MD5

      78250987584b2394fb1590f587bc9f6f

    • SHA1

      18290c77501235f5f7b8f5728e076aef6b7fd567

    • SHA256

      f865e7eddcdd476f8e2f6baa3ff80d2309ca04934ee21127399c392b1913b0d1

    • SHA512

      74cd48a6abfdf4014c1330445cab16fd36c9e7c9c2eb6b5ab262950bcc49091ab45a6fc022a634ee8628d6991dc7b9d48d45878d89074418914e5ac8231e6278

    • SSDEEP

      12288:9Mxx8WihpUDm/7DIuY0IlkNzbGKoS54TCCWvFD/cfUV:C8WinWm/7UuY0IlkNz6mkCC4Z/cS

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks