General

  • Target

    9363fd2f1e0f22405c75f0d1a2c79500

  • Size

    293KB

  • Sample

    240206-awpbbsdbgl

  • MD5

    9363fd2f1e0f22405c75f0d1a2c79500

  • SHA1

    05f5cfa7e26101c71e201bffe83bcbbc9facb561

  • SHA256

    0b50f4c64006bb2c8f9561318e5895bf6ba837d5d76b66287f7b1494e4ded11f

  • SHA512

    ce3e8b1144cabbb677f380331f95a1b8f41e5604f29ae1d359d3db2b6f8614cdda57924598ccb182e49bc21ae519fe4db820113717ed3d9215cd2966e5576399

  • SSDEEP

    6144:eKF+3AGzYE16mDf7gIjKLzdso6+yohORp3kcBp:a3RzYIBqsbohO7hp

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      9363fd2f1e0f22405c75f0d1a2c79500

    • Size

      293KB

    • MD5

      9363fd2f1e0f22405c75f0d1a2c79500

    • SHA1

      05f5cfa7e26101c71e201bffe83bcbbc9facb561

    • SHA256

      0b50f4c64006bb2c8f9561318e5895bf6ba837d5d76b66287f7b1494e4ded11f

    • SHA512

      ce3e8b1144cabbb677f380331f95a1b8f41e5604f29ae1d359d3db2b6f8614cdda57924598ccb182e49bc21ae519fe4db820113717ed3d9215cd2966e5576399

    • SSDEEP

      6144:eKF+3AGzYE16mDf7gIjKLzdso6+yohORp3kcBp:a3RzYIBqsbohO7hp

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks