General

  • Target

    cd17b2c46031e66804d97a63b7a345a6.exe

  • Size

    576KB

  • Sample

    240313-hh2y9sgh94

  • MD5

    cd17b2c46031e66804d97a63b7a345a6

  • SHA1

    e0fa10239aa18a8512d69cf3f26953f335f2ee9e

  • SHA256

    9de46b0a748d98ef7729fdb58886d16eea160fd8d5df186d1de86e369298ae15

  • SHA512

    3533f92fd8cd04b4f71c1b27fffa1e3d363d5996306130e96421649040a9d4d63d6f8823820940ce926a29d31570bf39045246ba694427c23a21fe7c79730ab1

  • SSDEEP

    12288:G4bTE1rkt826L4xd1EiEt6empQ+uK+ytymWFkPOmyDwW/7jgRwPeS:G4818EiYTmpZtyJF35HgR1S

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      cd17b2c46031e66804d97a63b7a345a6.exe

    • Size

      576KB

    • MD5

      cd17b2c46031e66804d97a63b7a345a6

    • SHA1

      e0fa10239aa18a8512d69cf3f26953f335f2ee9e

    • SHA256

      9de46b0a748d98ef7729fdb58886d16eea160fd8d5df186d1de86e369298ae15

    • SHA512

      3533f92fd8cd04b4f71c1b27fffa1e3d363d5996306130e96421649040a9d4d63d6f8823820940ce926a29d31570bf39045246ba694427c23a21fe7c79730ab1

    • SSDEEP

      12288:G4bTE1rkt826L4xd1EiEt6empQ+uK+ytymWFkPOmyDwW/7jgRwPeS:G4818EiYTmpZtyJF35HgR1S

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks