General

  • Target

    a664ecc708de93fc09419aabea109c4a

  • Size

    312KB

  • Sample

    240226-p3b2xadh89

  • MD5

    a664ecc708de93fc09419aabea109c4a

  • SHA1

    b3599d8b9da20b5fd2f759f9ae1d29f4e899a6dd

  • SHA256

    0f0dcf3c9e783f3297c03bed8780af5f0b8078d35530f2ff010def41e2ebcdc6

  • SHA512

    d9e27ba400d17427933e15d97c371469df3fa3424e78b39f5c8bf506d5fc0103ed009f06e9db373a2756542a30968df49dc9db173f3b9163c24dea4df10268af

  • SSDEEP

    6144:2kIovN3S8eZRalDd+FkrsRoGwq9sGod1D63:KCN35kRQMFksnwAs31D

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      a664ecc708de93fc09419aabea109c4a

    • Size

      312KB

    • MD5

      a664ecc708de93fc09419aabea109c4a

    • SHA1

      b3599d8b9da20b5fd2f759f9ae1d29f4e899a6dd

    • SHA256

      0f0dcf3c9e783f3297c03bed8780af5f0b8078d35530f2ff010def41e2ebcdc6

    • SHA512

      d9e27ba400d17427933e15d97c371469df3fa3424e78b39f5c8bf506d5fc0103ed009f06e9db373a2756542a30968df49dc9db173f3b9163c24dea4df10268af

    • SSDEEP

      6144:2kIovN3S8eZRalDd+FkrsRoGwq9sGod1D63:KCN35kRQMFksnwAs31D

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks