General

  • Target

    6fc78fde6186fabe86b0646e7b3638fb

  • Size

    341KB

  • Sample

    240122-stmzlaaca7

  • MD5

    6fc78fde6186fabe86b0646e7b3638fb

  • SHA1

    7bfa268827a802ed6f6843bf475d5e3397932060

  • SHA256

    19e6bef806fdfa5f715be7cc03ca1974732db164bf7dccaa59e130af3baff48b

  • SHA512

    fa76e058e6235275d3b2a97ee23230b8ef729fb5f65c8008d10c1a90c29a701adc81fdbe4f5882eaa5b69ba1911d9ecc1e363565dd5375e2ab3562b8a17107f4

  • SSDEEP

    3072:NmwQcBN2litkEwfBNjXnAg0FujksEHYjckD95ra5u2DMLdp1eNZGjREiGuAF:NfQcD2stkj5nAOoZqZ5rsMLF2F

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      6fc78fde6186fabe86b0646e7b3638fb

    • Size

      341KB

    • MD5

      6fc78fde6186fabe86b0646e7b3638fb

    • SHA1

      7bfa268827a802ed6f6843bf475d5e3397932060

    • SHA256

      19e6bef806fdfa5f715be7cc03ca1974732db164bf7dccaa59e130af3baff48b

    • SHA512

      fa76e058e6235275d3b2a97ee23230b8ef729fb5f65c8008d10c1a90c29a701adc81fdbe4f5882eaa5b69ba1911d9ecc1e363565dd5375e2ab3562b8a17107f4

    • SSDEEP

      3072:NmwQcBN2litkEwfBNjXnAg0FujksEHYjckD95ra5u2DMLdp1eNZGjREiGuAF:NfQcD2stkj5nAOoZqZ5rsMLF2F

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks