General

  • Target

    8a1c68fdf7483e79bd35948f12f017f4533aa48bc2e0476cb0b57bbcbabbedf2

  • Size

    268KB

  • Sample

    231101-hwlt7seb54

  • MD5

    384dad4a594921bc6f9a7b83a67378b6

  • SHA1

    8cad11c2b717d00b10f6d4c5ad23bbfce5b6b84f

  • SHA256

    8a1c68fdf7483e79bd35948f12f017f4533aa48bc2e0476cb0b57bbcbabbedf2

  • SHA512

    566cf7a974280fb74de02a9c5777fac297173edf6d966e80bef30e965386787992160006efec12bd8a13f96400dbf67cf9db0b225d8c54a02715a46b35ed19e8

  • SSDEEP

    6144:3seyuAwDSxiv4J2tLbOxwChL+OzfsAZ7NY2EZkEVFlHkaoiq4pQUk:3seyuAwDSxiv4J25b4DHH7W9FbZ7Bk

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      8a1c68fdf7483e79bd35948f12f017f4533aa48bc2e0476cb0b57bbcbabbedf2

    • Size

      268KB

    • MD5

      384dad4a594921bc6f9a7b83a67378b6

    • SHA1

      8cad11c2b717d00b10f6d4c5ad23bbfce5b6b84f

    • SHA256

      8a1c68fdf7483e79bd35948f12f017f4533aa48bc2e0476cb0b57bbcbabbedf2

    • SHA512

      566cf7a974280fb74de02a9c5777fac297173edf6d966e80bef30e965386787992160006efec12bd8a13f96400dbf67cf9db0b225d8c54a02715a46b35ed19e8

    • SSDEEP

      6144:3seyuAwDSxiv4J2tLbOxwChL+OzfsAZ7NY2EZkEVFlHkaoiq4pQUk:3seyuAwDSxiv4J25b4DHH7W9FbZ7Bk

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks