General

  • Target

    23dd3b2bf51ee633e80c1a0e26e46945

  • Size

    240KB

  • Sample

    231231-cjbktaeaf9

  • MD5

    23dd3b2bf51ee633e80c1a0e26e46945

  • SHA1

    af4c0dfbfb997ede4efc6312c235591cc4f8f4d1

  • SHA256

    0fd2e92c74d10a8da1e6a7855b580f29a1db7d60b21e6efad62599f822ddd1db

  • SHA512

    becd9775941fd781d7543e848fa533ffdef3fab4f87a8c9efa55d4ddab47a42779f4a85a9d9cd35bddbea3d33b953cae3b1497d53fe24eefbb952104690c2eb9

  • SSDEEP

    6144:RxB+FRj0j7FYdMf5InUsl1/smBnvy5yA8n:RKp0j7FY1nUsr0mw578n

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      23dd3b2bf51ee633e80c1a0e26e46945

    • Size

      240KB

    • MD5

      23dd3b2bf51ee633e80c1a0e26e46945

    • SHA1

      af4c0dfbfb997ede4efc6312c235591cc4f8f4d1

    • SHA256

      0fd2e92c74d10a8da1e6a7855b580f29a1db7d60b21e6efad62599f822ddd1db

    • SHA512

      becd9775941fd781d7543e848fa533ffdef3fab4f87a8c9efa55d4ddab47a42779f4a85a9d9cd35bddbea3d33b953cae3b1497d53fe24eefbb952104690c2eb9

    • SSDEEP

      6144:RxB+FRj0j7FYdMf5InUsl1/smBnvy5yA8n:RKp0j7FY1nUsr0mw578n

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks