General

  • Target

    fc33a7d5ca0ddb13d6264e1098b1c076cb1b5f2fded257e5723f71e10b7305e3.zip

  • Size

    190KB

  • Sample

    231227-lfg3vsabek

  • MD5

    585f17a427fc5da44af4d54b253a308c

  • SHA1

    00a00fb6b7975e16ca093e38922e03f4ccbe417d

  • SHA256

    ad33ddebebd501173ec02e5ea2d78740bc02d382b78141004a78117c242f0923

  • SHA512

    e46ccb427233def5e78399b2d40a364bfd1f54db4e069c78393394b69b96eabefd11490abdf5d070546f60b12d43eff55635c95f9b211735c5f1454bad694f9c

  • SSDEEP

    3072:ZpwR2hoQ3pHp6dt3dwJLxAkwWZg35lip0E9/U1lGjxZNeJ6XAfncsNibeTdGGlN:YR4oMJut3OL++gCmOM1onwpfncsNG6Gg

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ashfkwu.ru:9821

pomplus.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbx.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      C/ProgramData/Sentinel/AFUCache/fc33a7d5ca0ddb13d6264e1098b1c076cb1b5f2fded257e5723f71e10b7305e3

    • Size

      261KB

    • MD5

      9b3b95af652e2ed3472fc40a29d7c93d

    • SHA1

      8a9b4120d1c847c87ee51a7550c2085211c90403

    • SHA256

      fc33a7d5ca0ddb13d6264e1098b1c076cb1b5f2fded257e5723f71e10b7305e3

    • SHA512

      cbcdb2e32bebc9f3f0e5c10ff9b773182c36740dbefd1b5b864317452ca287f34df6b2317f2aa4a58bc1e9f7bd013b18c56a58f5e63a4c8a3b81d51f09ef5528

    • SSDEEP

      3072:qf5szh5HyUGZ/cTW++pAA3MfmsKMoJRcVmFB6OPQJgbodwLcprQMdLWyNU1arzJV:7d5HyUGfxqu/RFB6us7rPDQuR2X/VW

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks