General

  • Target

    584c115e2d68d99c1bbf33f01a795295

  • Size

    339KB

  • Sample

    231219-tj4d9sbcdq

  • MD5

    584c115e2d68d99c1bbf33f01a795295

  • SHA1

    aecafef6df8304bf7a1bba821a3303075523a677

  • SHA256

    b14743519ca2f7477f3f24050203b97a5df64d20fb3cd12b6455bdd0271b6f2a

  • SHA512

    bae2bd68d6e804407841a4a3ade1350c9d960521a5337027f7fffe4304e9875f3ec048003212dc8c8eb8094fed53af425cecae1950e6c1a2ff3d7bd68496fc44

  • SSDEEP

    6144:PL0jtKk5nAOXg/oaeIFSl+hDGSlsKiy8Gu5xZ5cLc:PyKqnFwBFSl+hDRsp8GxZCLc

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      584c115e2d68d99c1bbf33f01a795295

    • Size

      339KB

    • MD5

      584c115e2d68d99c1bbf33f01a795295

    • SHA1

      aecafef6df8304bf7a1bba821a3303075523a677

    • SHA256

      b14743519ca2f7477f3f24050203b97a5df64d20fb3cd12b6455bdd0271b6f2a

    • SHA512

      bae2bd68d6e804407841a4a3ade1350c9d960521a5337027f7fffe4304e9875f3ec048003212dc8c8eb8094fed53af425cecae1950e6c1a2ff3d7bd68496fc44

    • SSDEEP

      6144:PL0jtKk5nAOXg/oaeIFSl+hDGSlsKiy8Gu5xZ5cLc:PyKqnFwBFSl+hDRsp8GxZCLc

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks