General

  • Target

    536c4d776c8b163d673a8de51c9c453d

  • Size

    339KB

  • Sample

    240111-ntqm9sfbbp

  • MD5

    536c4d776c8b163d673a8de51c9c453d

  • SHA1

    f0010806d128337586b2f1ba2d7c4c2f13d9c2ea

  • SHA256

    27aa6bde03d85aceb7c47dfb3016bebb2151e664240aa8433c5a7f499da41eb8

  • SHA512

    7d2f74f4467273100801486026f75e7ac55363ace0682b243c26225d967dadc9ea41dc0b62631733274f53af648b9b68e0e5e6bf6ab2c1a9e5620dddc8e1b005

  • SSDEEP

    6144:PL0jtKk5nAOXl/oaeIFSl+hDGSlsKiy8Gu5xZ5cLc:PyKqnF9BFSl+hDRsp8GxZCLc

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      536c4d776c8b163d673a8de51c9c453d

    • Size

      339KB

    • MD5

      536c4d776c8b163d673a8de51c9c453d

    • SHA1

      f0010806d128337586b2f1ba2d7c4c2f13d9c2ea

    • SHA256

      27aa6bde03d85aceb7c47dfb3016bebb2151e664240aa8433c5a7f499da41eb8

    • SHA512

      7d2f74f4467273100801486026f75e7ac55363ace0682b243c26225d967dadc9ea41dc0b62631733274f53af648b9b68e0e5e6bf6ab2c1a9e5620dddc8e1b005

    • SSDEEP

      6144:PL0jtKk5nAOXl/oaeIFSl+hDGSlsKiy8Gu5xZ5cLc:PyKqnF9BFSl+hDRsp8GxZCLc

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks