General

  • Target

    ce3ea2f282a569827b6063c1184d1cbc

  • Size

    357KB

  • Sample

    240316-rgrlksee34

  • MD5

    ce3ea2f282a569827b6063c1184d1cbc

  • SHA1

    4e4b57ae15332dbacabff579a1d84ff6ed4127f5

  • SHA256

    d5fba51de2f87671b15dc3d5c497a9c7f9c268f183721634a958f7bbfb7d909e

  • SHA512

    39a3059f8ec575af5859f0bfc9d639f019eb5670cb9fd59305c3d576654b726d33df9e37334a428ff727d7da78ce82ead9fa07981eb876408e1f56b0b66d2043

  • SSDEEP

    6144:lVxqs5xhr8eyuWXlyu+7Y9NN9cMHiIteI+Q:lqCxhrhQ8ZYTteIj

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      ce3ea2f282a569827b6063c1184d1cbc

    • Size

      357KB

    • MD5

      ce3ea2f282a569827b6063c1184d1cbc

    • SHA1

      4e4b57ae15332dbacabff579a1d84ff6ed4127f5

    • SHA256

      d5fba51de2f87671b15dc3d5c497a9c7f9c268f183721634a958f7bbfb7d909e

    • SHA512

      39a3059f8ec575af5859f0bfc9d639f019eb5670cb9fd59305c3d576654b726d33df9e37334a428ff727d7da78ce82ead9fa07981eb876408e1f56b0b66d2043

    • SSDEEP

      6144:lVxqs5xhr8eyuWXlyu+7Y9NN9cMHiIteI+Q:lqCxhrhQ8ZYTteIj

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks