General

  • Target

    2cd0f0c0e7c4b4dd3d936753443ac22c

  • Size

    327KB

  • Sample

    231231-hy369sdafp

  • MD5

    2cd0f0c0e7c4b4dd3d936753443ac22c

  • SHA1

    d93cb79564d8135ba150cf5a3cfc42adf36c114a

  • SHA256

    1db915a9ba947eb2b4a46e12f0279796a9027b4cea04bd3668e9f6ada517b1f4

  • SHA512

    1053394fb2029b61bbedab844ffcc44471697cdfc57517a382df1041d36b7780f24489646c216386f53605f7e911be671e266b91aad0bf93e1d843e8683b9a57

  • SSDEEP

    6144:0kI2vN3S8eZRalDd+FkrsRoGwq9sGod1D63KMW5OWO:8YN35kRQMFksnwAs31DcYO

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      2cd0f0c0e7c4b4dd3d936753443ac22c

    • Size

      327KB

    • MD5

      2cd0f0c0e7c4b4dd3d936753443ac22c

    • SHA1

      d93cb79564d8135ba150cf5a3cfc42adf36c114a

    • SHA256

      1db915a9ba947eb2b4a46e12f0279796a9027b4cea04bd3668e9f6ada517b1f4

    • SHA512

      1053394fb2029b61bbedab844ffcc44471697cdfc57517a382df1041d36b7780f24489646c216386f53605f7e911be671e266b91aad0bf93e1d843e8683b9a57

    • SSDEEP

      6144:0kI2vN3S8eZRalDd+FkrsRoGwq9sGod1D63KMW5OWO:8YN35kRQMFksnwAs31DcYO

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks