General

  • Target

    99ada6c5f3a6f3812519d8db9daf589d

  • Size

    332KB

  • Sample

    240213-vmsmlsdd9w

  • MD5

    99ada6c5f3a6f3812519d8db9daf589d

  • SHA1

    e55ad7c38746d8cd1a8bc81a585bb07bb82c7a09

  • SHA256

    bd1e11364a3ff4abf6a18f37f7774b9f005f7fffcd618b210ec8213b9bb55ea5

  • SHA512

    d53c187570b27700800c9883c4c7879fb074398cbc565977f26d742380628d835d929c74161d6f4a1ded0b904f16ab97df1092f03acc7d1e0eda7fc61076c475

  • SSDEEP

    3072:mj9L6MtOexbzwGBNZAg0FuK6Aksp8fa1/oOdiK7UvJVtW8s97t7xtrjOBtno2OUT:mZ7tHtT/AOjjK/okiK7UvPumfMqhKwC0

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      99ada6c5f3a6f3812519d8db9daf589d

    • Size

      332KB

    • MD5

      99ada6c5f3a6f3812519d8db9daf589d

    • SHA1

      e55ad7c38746d8cd1a8bc81a585bb07bb82c7a09

    • SHA256

      bd1e11364a3ff4abf6a18f37f7774b9f005f7fffcd618b210ec8213b9bb55ea5

    • SHA512

      d53c187570b27700800c9883c4c7879fb074398cbc565977f26d742380628d835d929c74161d6f4a1ded0b904f16ab97df1092f03acc7d1e0eda7fc61076c475

    • SSDEEP

      3072:mj9L6MtOexbzwGBNZAg0FuK6Aksp8fa1/oOdiK7UvJVtW8s97t7xtrjOBtno2OUT:mZ7tHtT/AOjjK/okiK7UvPumfMqhKwC0

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks