General

  • Target

    ad8c6c49d5f6b1b730001a038d379960

  • Size

    317KB

  • Sample

    240229-dsjs8aca61

  • MD5

    ad8c6c49d5f6b1b730001a038d379960

  • SHA1

    061f59f11682195f3fb0cf13ad18e3fbe929c387

  • SHA256

    4552c1725ef9fe9174417b33fd686d6ff37115835011b014d0e16076efddf596

  • SHA512

    095ff688d934c76124a51fd0a97a5c92fa77aab7b11994f29ad42f9962c7e92a97383b2c92fc6eae549028fb66cbd1671707b6b78b959d9be6ba6d8c0896c8e9

  • SSDEEP

    6144:af1NM07z4Z+yedAfDCTgJ4n//57s1NLU/6v9Ue7Ss5vQpT:2Y07zg+y8AJK/x7eGeesA

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      ad8c6c49d5f6b1b730001a038d379960

    • Size

      317KB

    • MD5

      ad8c6c49d5f6b1b730001a038d379960

    • SHA1

      061f59f11682195f3fb0cf13ad18e3fbe929c387

    • SHA256

      4552c1725ef9fe9174417b33fd686d6ff37115835011b014d0e16076efddf596

    • SHA512

      095ff688d934c76124a51fd0a97a5c92fa77aab7b11994f29ad42f9962c7e92a97383b2c92fc6eae549028fb66cbd1671707b6b78b959d9be6ba6d8c0896c8e9

    • SSDEEP

      6144:af1NM07z4Z+yedAfDCTgJ4n//57s1NLU/6v9Ue7Ss5vQpT:2Y07zg+y8AJK/x7eGeesA

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks