General

  • Target

    789.txt

  • Size

    212KB

  • Sample

    231102-cr6qxshb27

  • MD5

    d0a09a576bda333bdd0c774d30e3c87a

  • SHA1

    806b8e83860eca7f9c5f50baaa916589e294bc8a

  • SHA256

    70b6dde721d6dd8048ce2b832b581b04b35161efa3ab41659addd8e61ea4ff30

  • SHA512

    da9e9abdb023909fd615fa2b250232de69341940ab39243844eaf79e3457dc41e79bdc4b29cc83829d53543f84d1e64f1ce2a9ce8c90ec93a99b05e033e0d80e

  • SSDEEP

    1536:Nvl9eja1se+nsngcxNEsYMltfMpx7p5AzwB5GEvVVWbmZvM3R8krfaL+ETWfF99F:Nvln1p+nC7fUn5VVccPTWfFIzeSS

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Targets

    • Target

      789.txt

    • Size

      212KB

    • MD5

      d0a09a576bda333bdd0c774d30e3c87a

    • SHA1

      806b8e83860eca7f9c5f50baaa916589e294bc8a

    • SHA256

      70b6dde721d6dd8048ce2b832b581b04b35161efa3ab41659addd8e61ea4ff30

    • SHA512

      da9e9abdb023909fd615fa2b250232de69341940ab39243844eaf79e3457dc41e79bdc4b29cc83829d53543f84d1e64f1ce2a9ce8c90ec93a99b05e033e0d80e

    • SSDEEP

      1536:Nvl9eja1se+nsngcxNEsYMltfMpx7p5AzwB5GEvVVWbmZvM3R8krfaL+ETWfF99F:Nvln1p+nC7fUn5VVccPTWfFIzeSS

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks