General

  • Target

    db36221937e7d6444a2123f6cc4b3193

  • Size

    296KB

  • Sample

    240321-kr8jhshc3t

  • MD5

    db36221937e7d6444a2123f6cc4b3193

  • SHA1

    4c446f4f7d78cb4ae45dc4fba2b1895a78a505b7

  • SHA256

    403f2bc5c6eb0c1920c5785daa9620e910ff4e89b7f53d719e7e14c7557552c2

  • SHA512

    0712109f71c20e797421e27d424478c1693df7c005f6ad0b72f4aa64ba613210f163b31913b3cacda4914557d81a4794431fff3e764479e4de729627ed83e2e7

  • SSDEEP

    3072:JHBXjAJM1Qorw2nE/YmmyAY1VHYCdD43fJLRZaimmwBRspAdM1bg0+SElYhfPZ3h:JlEMMmZYHYuD6flaFwsFkhn

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      db36221937e7d6444a2123f6cc4b3193

    • Size

      296KB

    • MD5

      db36221937e7d6444a2123f6cc4b3193

    • SHA1

      4c446f4f7d78cb4ae45dc4fba2b1895a78a505b7

    • SHA256

      403f2bc5c6eb0c1920c5785daa9620e910ff4e89b7f53d719e7e14c7557552c2

    • SHA512

      0712109f71c20e797421e27d424478c1693df7c005f6ad0b72f4aa64ba613210f163b31913b3cacda4914557d81a4794431fff3e764479e4de729627ed83e2e7

    • SSDEEP

      3072:JHBXjAJM1Qorw2nE/YmmyAY1VHYCdD43fJLRZaimmwBRspAdM1bg0+SElYhfPZ3h:JlEMMmZYHYuD6flaFwsFkhn

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks