General

  • Target

    51764fc9068bdd6543ab1a06d099dfa0

  • Size

    339KB

  • Sample

    240110-ym16jagbe5

  • MD5

    51764fc9068bdd6543ab1a06d099dfa0

  • SHA1

    f555e9b400ac62e26862ac837f98871818d65472

  • SHA256

    774c13f6456d3f970327e13a4ac4029b6fedfe8b2469aee693279fd37189fb19

  • SHA512

    9a8c222e620292f80efac5d97f14d7319b3f9e5aea671838793e2b73cc01fa4efe39a3bfa0a959a87e71893e2929b0d5eb8a4f399522d4f915a1f37558727825

  • SSDEEP

    6144:oLSOpH4xnZ5nAOrlargQhImeQoYVxidcDQ82NqgKqU:ox4xnn7argQhV/T7idcDQPA5

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      51764fc9068bdd6543ab1a06d099dfa0

    • Size

      339KB

    • MD5

      51764fc9068bdd6543ab1a06d099dfa0

    • SHA1

      f555e9b400ac62e26862ac837f98871818d65472

    • SHA256

      774c13f6456d3f970327e13a4ac4029b6fedfe8b2469aee693279fd37189fb19

    • SHA512

      9a8c222e620292f80efac5d97f14d7319b3f9e5aea671838793e2b73cc01fa4efe39a3bfa0a959a87e71893e2929b0d5eb8a4f399522d4f915a1f37558727825

    • SSDEEP

      6144:oLSOpH4xnZ5nAOrlargQhImeQoYVxidcDQ82NqgKqU:ox4xnn7argQhV/T7idcDQPA5

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks