General

  • Target

    3e965a35b69836129f1d4d30b3c4117f

  • Size

    340KB

  • Sample

    240103-qjzvasfhd5

  • MD5

    3e965a35b69836129f1d4d30b3c4117f

  • SHA1

    2a5a3a03d653442f58d3c403b7b57c9296087cfa

  • SHA256

    7dc34acf3cf4a41af8284ab263ea729c0e539db9c2539e6d6643d063b2b2d302

  • SHA512

    cd3ae3dc6cef62cb7079852a9e9ac8f2bf64ade3c3fa4dd2e0b7c086ab0a3a4054d313e249a0d180d6ef2817e376cd05155f6194901d6ab3146899bb42862c7f

  • SSDEEP

    3072:pmjTKNQnR0r8FIwQBNjXnAg0FuGksquMo3PHlzPX4XeOE6kl29vxCFb14tGKbu2z:pATKsRk8g5nAOraFaJEh2DWqG8U

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      3e965a35b69836129f1d4d30b3c4117f

    • Size

      340KB

    • MD5

      3e965a35b69836129f1d4d30b3c4117f

    • SHA1

      2a5a3a03d653442f58d3c403b7b57c9296087cfa

    • SHA256

      7dc34acf3cf4a41af8284ab263ea729c0e539db9c2539e6d6643d063b2b2d302

    • SHA512

      cd3ae3dc6cef62cb7079852a9e9ac8f2bf64ade3c3fa4dd2e0b7c086ab0a3a4054d313e249a0d180d6ef2817e376cd05155f6194901d6ab3146899bb42862c7f

    • SSDEEP

      3072:pmjTKNQnR0r8FIwQBNjXnAg0FuGksquMo3PHlzPX4XeOE6kl29vxCFb14tGKbu2z:pATKsRk8g5nAOraFaJEh2DWqG8U

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks