General

  • Target

    42fee21b-30a2-ac48-bbb9-c6eae04ce8ae.exe

  • Size

    261KB

  • Sample

    240321-qzc1gaec4t

  • MD5

    e381028b496c601a9e0024d3a10b8d0e

  • SHA1

    bc28c3e44f65bec3e9fc0e3112027a9ade6969c6

  • SHA256

    382e891853d6e7cc04ad6c569b64b2d6ef09d2b07740e15282708b322c3a2a6c

  • SHA512

    7c90bcd7a136288e9ecd819e87a857009ca5802e0a0e9aff034cdb1ea7c23688dbc0ed074fa2e9dc7cf9ddabc9bc3fdd935e97e08665cdaf3bc0695d919fbe3b

  • SSDEEP

    6144:0eBlISBwLaYlW8n0WkmpTKLCldp47wifieoajIOi1Ab:DB/eLXlW8n1ZKOLdUn4A

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ashfkwu.ru:9821

pomplus.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbx.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      42fee21b-30a2-ac48-bbb9-c6eae04ce8ae.exe

    • Size

      261KB

    • MD5

      e381028b496c601a9e0024d3a10b8d0e

    • SHA1

      bc28c3e44f65bec3e9fc0e3112027a9ade6969c6

    • SHA256

      382e891853d6e7cc04ad6c569b64b2d6ef09d2b07740e15282708b322c3a2a6c

    • SHA512

      7c90bcd7a136288e9ecd819e87a857009ca5802e0a0e9aff034cdb1ea7c23688dbc0ed074fa2e9dc7cf9ddabc9bc3fdd935e97e08665cdaf3bc0695d919fbe3b

    • SSDEEP

      6144:0eBlISBwLaYlW8n0WkmpTKLCldp47wifieoajIOi1Ab:DB/eLXlW8n1ZKOLdUn4A

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks