General

  • Target

    935e22f59598cdf46296d5cb92e8d3b22363190ec7c7eeb085eae0a9a54b9342

  • Size

    312KB

  • Sample

    231030-nhcx2aec89

  • MD5

    ca9425b8b07f1e88640105a6983c530b

  • SHA1

    2d80f7ab07d0dd8f054a06be63854e354c016f18

  • SHA256

    935e22f59598cdf46296d5cb92e8d3b22363190ec7c7eeb085eae0a9a54b9342

  • SHA512

    1e2768f91f22d5573d4e497a593c85abb5edd6381a5744808a0b61e7299fb71e5348a81d8e5f3dd54dc62f03d42bac5ec4f63a43451326ebf96bb12b9a8e629d

  • SSDEEP

    6144:hn9+9wPbNTK0Q/fvzKZ62jY/776KOWu/GduR9swnApRTv+:h9RTG/fvyLj472KOv/GduzsJpRq

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Targets

    • Target

      935e22f59598cdf46296d5cb92e8d3b22363190ec7c7eeb085eae0a9a54b9342

    • Size

      312KB

    • MD5

      ca9425b8b07f1e88640105a6983c530b

    • SHA1

      2d80f7ab07d0dd8f054a06be63854e354c016f18

    • SHA256

      935e22f59598cdf46296d5cb92e8d3b22363190ec7c7eeb085eae0a9a54b9342

    • SHA512

      1e2768f91f22d5573d4e497a593c85abb5edd6381a5744808a0b61e7299fb71e5348a81d8e5f3dd54dc62f03d42bac5ec4f63a43451326ebf96bb12b9a8e629d

    • SSDEEP

      6144:hn9+9wPbNTK0Q/fvzKZ62jY/776KOWu/GduR9swnApRTv+:h9RTG/fvyLj472KOv/GduzsJpRq

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks