General

  • Target

    0e76fbd3344db02ec2de3787c6accb67

  • Size

    341KB

  • Sample

    231221-1223gseah3

  • MD5

    0e76fbd3344db02ec2de3787c6accb67

  • SHA1

    6740e1ff173a6d2a4e5062c5d7f31dfedf909f3d

  • SHA256

    dac037743fa405688c72c44bd2957b2d0083349b4fb1657ecafeeec89f5202ff

  • SHA512

    5fb6da7c498f954ee77e03f80eb9f6a8a436cc28816ec8f52664671cd95416c7c5dd19f994efa2facbbaea7569e2a3556fdd51de3aaa445671dd6b8041274638

  • SSDEEP

    6144:CgNTmz5KhGX5nAON1F8RqZp5EpmrP7CbKQNMd3P:CgqKhGpnJqipypmrPZUK

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      0e76fbd3344db02ec2de3787c6accb67

    • Size

      341KB

    • MD5

      0e76fbd3344db02ec2de3787c6accb67

    • SHA1

      6740e1ff173a6d2a4e5062c5d7f31dfedf909f3d

    • SHA256

      dac037743fa405688c72c44bd2957b2d0083349b4fb1657ecafeeec89f5202ff

    • SHA512

      5fb6da7c498f954ee77e03f80eb9f6a8a436cc28816ec8f52664671cd95416c7c5dd19f994efa2facbbaea7569e2a3556fdd51de3aaa445671dd6b8041274638

    • SSDEEP

      6144:CgNTmz5KhGX5nAON1F8RqZp5EpmrP7CbKQNMd3P:CgqKhGpnJqipypmrPZUK

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks