General

  • Target

    8a8570959e0ab510832bfc4d0ba1606f

  • Size

    339KB

  • Sample

    231222-n5574abge8

  • MD5

    8a8570959e0ab510832bfc4d0ba1606f

  • SHA1

    08b2be718ebb7cc91c169003f41c7154bf493de1

  • SHA256

    e7b3fbb00d4800da9c85e938a001513f6115223f731127054ebe57c977b9f44b

  • SHA512

    cba67b2a8d21ca4ffbaed77acb53943d8828ba076149be6c4b5cc7686e3e5d54785f8e8fac36cdb0ecb507f2a195498a9f52e2de569207b2a5782664f900fd5e

  • SSDEEP

    6144:oLSOpH4xnZ5nAOrlurgQhImeQoYVxidcDQ82NqgKqU:ox4xnn7urgQhV/T7idcDQPA5

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      8a8570959e0ab510832bfc4d0ba1606f

    • Size

      339KB

    • MD5

      8a8570959e0ab510832bfc4d0ba1606f

    • SHA1

      08b2be718ebb7cc91c169003f41c7154bf493de1

    • SHA256

      e7b3fbb00d4800da9c85e938a001513f6115223f731127054ebe57c977b9f44b

    • SHA512

      cba67b2a8d21ca4ffbaed77acb53943d8828ba076149be6c4b5cc7686e3e5d54785f8e8fac36cdb0ecb507f2a195498a9f52e2de569207b2a5782664f900fd5e

    • SSDEEP

      6144:oLSOpH4xnZ5nAOrlurgQhImeQoYVxidcDQ82NqgKqU:ox4xnn7urgQhV/T7idcDQPA5

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks