General

  • Target

    b91edd023f06387648f27387b0235c2e

  • Size

    308KB

  • Sample

    231222-rgrataabc9

  • MD5

    b91edd023f06387648f27387b0235c2e

  • SHA1

    2b575f897e058ed5d0d20696932a52d9dcb93f8a

  • SHA256

    28aaa4324d6c66af5cc4dbc4ed5cc57e0eaeea0c2138ce19f74541548f39150a

  • SHA512

    d893652b29b9c430d34bc6ebc2fb727d46226c63d2bbc96f9b4f20a7f3cfb743e06cb56912c2705c6058c2476dbb9109b5f9e3cddcf839dd0c681d6c1844a518

  • SSDEEP

    6144:I+DwapcVPStGWs/LW82p2uxd/Mj2R3B7CyUOxzS0ieRh:PDwap+PVWme2m/MjxMqeR

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      b91edd023f06387648f27387b0235c2e

    • Size

      308KB

    • MD5

      b91edd023f06387648f27387b0235c2e

    • SHA1

      2b575f897e058ed5d0d20696932a52d9dcb93f8a

    • SHA256

      28aaa4324d6c66af5cc4dbc4ed5cc57e0eaeea0c2138ce19f74541548f39150a

    • SHA512

      d893652b29b9c430d34bc6ebc2fb727d46226c63d2bbc96f9b4f20a7f3cfb743e06cb56912c2705c6058c2476dbb9109b5f9e3cddcf839dd0c681d6c1844a518

    • SSDEEP

      6144:I+DwapcVPStGWs/LW82p2uxd/Mj2R3B7CyUOxzS0ieRh:PDwap+PVWme2m/MjxMqeR

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks