General

  • Target

    2b38fc9b3c416b987549bf7ae8774d4f

  • Size

    296KB

  • Sample

    231231-gv6bsaeec4

  • MD5

    2b38fc9b3c416b987549bf7ae8774d4f

  • SHA1

    dacc82dffca49130711d15db3001bb6829e4f8a6

  • SHA256

    010c35588e9a1f20a6304cbcf737d2d311b4ac17e7d1a56184fccdea2974b71a

  • SHA512

    00956fbb70d9b29dd7daa30ca03f168e0b988c1a2c7164767ffc9a9ab31e92a207ed047bf2ae33470a2b6d5595a6ceacd03280920d2e12ddadb3c2722e62d8ba

  • SSDEEP

    3072:JHBXjAJM1Qorw2nE/dmmyAY1VHYCdD43fJLRZaimmwBRspAdM1bg0+SElYhfPZ3h:JlEMxmZYHYuD6flaFwsFkhn

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      2b38fc9b3c416b987549bf7ae8774d4f

    • Size

      296KB

    • MD5

      2b38fc9b3c416b987549bf7ae8774d4f

    • SHA1

      dacc82dffca49130711d15db3001bb6829e4f8a6

    • SHA256

      010c35588e9a1f20a6304cbcf737d2d311b4ac17e7d1a56184fccdea2974b71a

    • SHA512

      00956fbb70d9b29dd7daa30ca03f168e0b988c1a2c7164767ffc9a9ab31e92a207ed047bf2ae33470a2b6d5595a6ceacd03280920d2e12ddadb3c2722e62d8ba

    • SSDEEP

      3072:JHBXjAJM1Qorw2nE/dmmyAY1VHYCdD43fJLRZaimmwBRspAdM1bg0+SElYhfPZ3h:JlEMxmZYHYuD6flaFwsFkhn

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks