General

  • Target

    14f4897561755b674c450846fc54935c

  • Size

    456KB

  • Sample

    231225-lqeqgsbab2

  • MD5

    14f4897561755b674c450846fc54935c

  • SHA1

    c45610e58f74ef0f24a1e6f901b8ee2a517f2377

  • SHA256

    3efd7cc627b62bcd5810baa836f4bca0d423f086745a110fd935000acaef7268

  • SHA512

    e08795c69bfed7c12e524c04007b24a15acf730c41789c909613ec8a6d93e62b776b3faf7961d1978f43e300ad398f78db4e8b5b6812aa371da39dd1d549fec1

  • SSDEEP

    6144:tWtzjJ2Qo7nHAOtm/wUT4Eo4joWqf8+w3pso0i:tIcQ2Hi/z7o4/qf8hV

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      14f4897561755b674c450846fc54935c

    • Size

      456KB

    • MD5

      14f4897561755b674c450846fc54935c

    • SHA1

      c45610e58f74ef0f24a1e6f901b8ee2a517f2377

    • SHA256

      3efd7cc627b62bcd5810baa836f4bca0d423f086745a110fd935000acaef7268

    • SHA512

      e08795c69bfed7c12e524c04007b24a15acf730c41789c909613ec8a6d93e62b776b3faf7961d1978f43e300ad398f78db4e8b5b6812aa371da39dd1d549fec1

    • SSDEEP

      6144:tWtzjJ2Qo7nHAOtm/wUT4Eo4joWqf8+w3pso0i:tIcQ2Hi/z7o4/qf8hV

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks