General

  • Target

    3ad1cb1b6d01d0aa02714f3956c101bee1dfc3901c6d56ac41cdef79f87aa428

  • Size

    312KB

  • Sample

    231103-j9e49aed5y

  • MD5

    3cf42f23201ad62bc02e019d8d8f3a46

  • SHA1

    e9b92f529821f0d31c4695a2f57d1edd28e20ddf

  • SHA256

    3ad1cb1b6d01d0aa02714f3956c101bee1dfc3901c6d56ac41cdef79f87aa428

  • SHA512

    1a230749e4731a8315528315184aa4b0cb8a3c8b81f0112c88a0d7d576c57e7a706ee5ace8776c65c598a4f6c8bfe15b0f4d1c3a425f0b7a6d9aa3acaaec5b4e

  • SSDEEP

    3072:LxB25tyO6JMGtdataw4zPaCtpWCgChu2vl5nb2M9CJAQrOoPrMG6RPgPf/RE3kVj:9o5tyAG3pZ023qbrV6RPcRr65s

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      3ad1cb1b6d01d0aa02714f3956c101bee1dfc3901c6d56ac41cdef79f87aa428

    • Size

      312KB

    • MD5

      3cf42f23201ad62bc02e019d8d8f3a46

    • SHA1

      e9b92f529821f0d31c4695a2f57d1edd28e20ddf

    • SHA256

      3ad1cb1b6d01d0aa02714f3956c101bee1dfc3901c6d56ac41cdef79f87aa428

    • SHA512

      1a230749e4731a8315528315184aa4b0cb8a3c8b81f0112c88a0d7d576c57e7a706ee5ace8776c65c598a4f6c8bfe15b0f4d1c3a425f0b7a6d9aa3acaaec5b4e

    • SSDEEP

      3072:LxB25tyO6JMGtdataw4zPaCtpWCgChu2vl5nb2M9CJAQrOoPrMG6RPgPf/RE3kVj:9o5tyAG3pZ023qbrV6RPcRr65s

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks