General

  • Target

    e940399c01f058bdb841971c1eef4cd1

  • Size

    286KB

  • Sample

    231220-t27jmscgdm

  • MD5

    e940399c01f058bdb841971c1eef4cd1

  • SHA1

    4b570eb43341e25c3d8bfbdb4ece454bd6149a25

  • SHA256

    f8c0baed71b062c258f64c49ab7435123d5762406c73127279b1ce2c74f920a2

  • SHA512

    918f17ded5aa912742b9910299a566cd95cd85fb3590da13d5a5198317d942c156dc468844d147fa1ebed68a522b683ae4841174c89aae106dfa4128245d7303

  • SSDEEP

    6144:8jAj1giC7eSnkZHA9jn1YxlHzBKGjO1WQSKs:88jSeSnka9T124aKs

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      e940399c01f058bdb841971c1eef4cd1

    • Size

      286KB

    • MD5

      e940399c01f058bdb841971c1eef4cd1

    • SHA1

      4b570eb43341e25c3d8bfbdb4ece454bd6149a25

    • SHA256

      f8c0baed71b062c258f64c49ab7435123d5762406c73127279b1ce2c74f920a2

    • SHA512

      918f17ded5aa912742b9910299a566cd95cd85fb3590da13d5a5198317d942c156dc468844d147fa1ebed68a522b683ae4841174c89aae106dfa4128245d7303

    • SSDEEP

      6144:8jAj1giC7eSnkZHA9jn1YxlHzBKGjO1WQSKs:88jSeSnka9T124aKs

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks