General

  • Target

    8455cc8478b232b2ac9eff9c0eec87c4

  • Size

    308KB

  • Sample

    240131-nxtjbsbea2

  • MD5

    8455cc8478b232b2ac9eff9c0eec87c4

  • SHA1

    ca1df26039f8bdfb732b5d864f59065e204fa717

  • SHA256

    2a20ad60b847eda43edde26463d35487597922d7c26fd6302ba521ad176b92e7

  • SHA512

    e931a17e70cd050653800b15e3ed3a0b9fd6a8db85175da8057ac887284da4fa469a7fdc6ca11b7dcfd8081b8514a72656c9f14500ab401ac94db57ee134d197

  • SSDEEP

    6144:5oeswsod/tqtoCcSoFCeCz9Y0b3tjABaWa0E2:5oeswlevuFTC3d0E

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      8455cc8478b232b2ac9eff9c0eec87c4

    • Size

      308KB

    • MD5

      8455cc8478b232b2ac9eff9c0eec87c4

    • SHA1

      ca1df26039f8bdfb732b5d864f59065e204fa717

    • SHA256

      2a20ad60b847eda43edde26463d35487597922d7c26fd6302ba521ad176b92e7

    • SHA512

      e931a17e70cd050653800b15e3ed3a0b9fd6a8db85175da8057ac887284da4fa469a7fdc6ca11b7dcfd8081b8514a72656c9f14500ab401ac94db57ee134d197

    • SSDEEP

      6144:5oeswsod/tqtoCcSoFCeCz9Y0b3tjABaWa0E2:5oeswlevuFTC3d0E

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks