General

  • Target

    292e55b0280ca23588da3c0dc89471f7

  • Size

    1.5MB

  • Sample

    231225-sty2vshff2

  • MD5

    292e55b0280ca23588da3c0dc89471f7

  • SHA1

    684ef8adec435496b864d106fe88fc0f53d30015

  • SHA256

    3e9935bd5f04382935b4749329aa24466992d1ff7f7ab93330a26ff78876b0e5

  • SHA512

    f1177186728f6a7669fcb51810e275553fe477c8112535a52a501127b4dc34ebf2d6ce85330ff99a993b1f4cfa779d1e440cda9ad45ea6689ecfe7cbf3d1b11f

  • SSDEEP

    3072:KY54bnV85uAoiytBwjJs8SZZIR+QJWQK9RsTNlKrfZPKFl3UM+b7ZPkN2D8tWQAN:0nMuAoiOB2Jsf85NKf8NQk+Q9rL

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ashfkwu.ru:9821

yekfhsh.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      292e55b0280ca23588da3c0dc89471f7

    • Size

      1.5MB

    • MD5

      292e55b0280ca23588da3c0dc89471f7

    • SHA1

      684ef8adec435496b864d106fe88fc0f53d30015

    • SHA256

      3e9935bd5f04382935b4749329aa24466992d1ff7f7ab93330a26ff78876b0e5

    • SHA512

      f1177186728f6a7669fcb51810e275553fe477c8112535a52a501127b4dc34ebf2d6ce85330ff99a993b1f4cfa779d1e440cda9ad45ea6689ecfe7cbf3d1b11f

    • SSDEEP

      3072:KY54bnV85uAoiytBwjJs8SZZIR+QJWQK9RsTNlKrfZPKFl3UM+b7ZPkN2D8tWQAN:0nMuAoiOB2Jsf85NKf8NQk+Q9rL

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks