General

  • Target

    24b032f29a1a947f1c65090c2bae96d1fffb33e9e546dbcc413c7a1ddb6e5283

  • Size

    576KB

  • Sample

    240322-wq1caseg28

  • MD5

    5a222c7172583195cc21e3a6f723cf7f

  • SHA1

    3f4aaf39675d570731e46902d2e3d4cf065c87ed

  • SHA256

    24b032f29a1a947f1c65090c2bae96d1fffb33e9e546dbcc413c7a1ddb6e5283

  • SHA512

    0b22d3fd52d74230b8f77a53839cdc077f82664ec63ba91c60b4de40fa3934ffee1aa933d921b20d1b2a3efcf8e3ae3f4f5b926bc3d02e0ef467bf204a91f5c9

  • SSDEEP

    12288:b0bTE1rkt826L4xd1EiEt6empQ+uK+v1jqmgsz1SCeE1zcugekjAH9:b0818EiYTmpstqmhNguz9

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      24b032f29a1a947f1c65090c2bae96d1fffb33e9e546dbcc413c7a1ddb6e5283

    • Size

      576KB

    • MD5

      5a222c7172583195cc21e3a6f723cf7f

    • SHA1

      3f4aaf39675d570731e46902d2e3d4cf065c87ed

    • SHA256

      24b032f29a1a947f1c65090c2bae96d1fffb33e9e546dbcc413c7a1ddb6e5283

    • SHA512

      0b22d3fd52d74230b8f77a53839cdc077f82664ec63ba91c60b4de40fa3934ffee1aa933d921b20d1b2a3efcf8e3ae3f4f5b926bc3d02e0ef467bf204a91f5c9

    • SSDEEP

      12288:b0bTE1rkt826L4xd1EiEt6empQ+uK+v1jqmgsz1SCeE1zcugekjAH9:b0818EiYTmpstqmhNguz9

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks