General

  • Target

    fbe0b13bfa359cffd47774669378d7e5

  • Size

    306KB

  • Sample

    231220-wccn3sdcd2

  • MD5

    fbe0b13bfa359cffd47774669378d7e5

  • SHA1

    2a80a080366637886b8690eff37a41e42ce84963

  • SHA256

    a9c75a2b8d18432e7428dce1026474e4c0eac370a032654a38cc911d1a04e760

  • SHA512

    e886099c80072deff37cf4048149e6aa48508e69d878b3e5b48fbe159ef531c5959b2fb888a8a117da0567d9e0399290f0b97e8b57b7fe8661c9daa57404ca5f

  • SSDEEP

    6144:TkffgLMn3vkkrpopJEFGLEGGwbHA8wAL1XsyrvvJwju:wQQ3vhopJBtsXPwx9

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      fbe0b13bfa359cffd47774669378d7e5

    • Size

      306KB

    • MD5

      fbe0b13bfa359cffd47774669378d7e5

    • SHA1

      2a80a080366637886b8690eff37a41e42ce84963

    • SHA256

      a9c75a2b8d18432e7428dce1026474e4c0eac370a032654a38cc911d1a04e760

    • SHA512

      e886099c80072deff37cf4048149e6aa48508e69d878b3e5b48fbe159ef531c5959b2fb888a8a117da0567d9e0399290f0b97e8b57b7fe8661c9daa57404ca5f

    • SSDEEP

      6144:TkffgLMn3vkkrpopJEFGLEGGwbHA8wAL1XsyrvvJwju:wQQ3vhopJBtsXPwx9

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks