General

  • Target

    SecuriteInfo.com.Trojan.Siggen26.13995.11728.18139.exe

  • Size

    576KB

  • Sample

    240308-g4wtpsab6x

  • MD5

    6071162642b20b753aa0453beac9f2c8

  • SHA1

    f3273a79468202037b5748116268a374b4caa2a1

  • SHA256

    f2861c4e233f053002899cf60d8070b257bc984c049aaee8bb734a3b9d20b4eb

  • SHA512

    329c00654671f6a69d0ca00f692b80fb311c56e741076e880015398e9f001b0388f9d1757e8f1873ca715d1fe1aaa5230578fb3050a4e8572a84796b903068f4

  • SSDEEP

    12288:KkbTE1rkt826L4xd1EiEt6empQ+uK+KVUhM+1n3+daYXQnG7kW:Kk818EiYTmp16DUdP4W

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      SecuriteInfo.com.Trojan.Siggen26.13995.11728.18139.exe

    • Size

      576KB

    • MD5

      6071162642b20b753aa0453beac9f2c8

    • SHA1

      f3273a79468202037b5748116268a374b4caa2a1

    • SHA256

      f2861c4e233f053002899cf60d8070b257bc984c049aaee8bb734a3b9d20b4eb

    • SHA512

      329c00654671f6a69d0ca00f692b80fb311c56e741076e880015398e9f001b0388f9d1757e8f1873ca715d1fe1aaa5230578fb3050a4e8572a84796b903068f4

    • SSDEEP

      12288:KkbTE1rkt826L4xd1EiEt6empQ+uK+KVUhM+1n3+daYXQnG7kW:Kk818EiYTmp16DUdP4W

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks