General

  • Target

    fce80c39c52f21e555458cc1e6ea71a9

  • Size

    344KB

  • Sample

    231220-went5abefj

  • MD5

    fce80c39c52f21e555458cc1e6ea71a9

  • SHA1

    adb39ecac8c0d13483e8be66589d36a68889ff8d

  • SHA256

    c8c2fd912cb1bdd0a79c1f93be58f358579cacd701a8336524100ab7cbc8c4c7

  • SHA512

    06966e5264456ff4aa8266477f1499d7e929b6d2ec81f1ee73c196349f91517b23fdfb90f54e61a98bc49637cd0d5e36b1094c596575a956f95b56b4223e96d2

  • SSDEEP

    3072:OS+kPPCHL9zwdXnAg0FuBh5BksvdB4K6J4dHtnauAYDkI2Nmr+ihWBBqxmOm+VEw:DqHxcnAOl2DrJ4DPAnA+jSDVQnTA

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      fce80c39c52f21e555458cc1e6ea71a9

    • Size

      344KB

    • MD5

      fce80c39c52f21e555458cc1e6ea71a9

    • SHA1

      adb39ecac8c0d13483e8be66589d36a68889ff8d

    • SHA256

      c8c2fd912cb1bdd0a79c1f93be58f358579cacd701a8336524100ab7cbc8c4c7

    • SHA512

      06966e5264456ff4aa8266477f1499d7e929b6d2ec81f1ee73c196349f91517b23fdfb90f54e61a98bc49637cd0d5e36b1094c596575a956f95b56b4223e96d2

    • SSDEEP

      3072:OS+kPPCHL9zwdXnAg0FuBh5BksvdB4K6J4dHtnauAYDkI2Nmr+ihWBBqxmOm+VEw:DqHxcnAOl2DrJ4DPAnA+jSDVQnTA

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks