General

  • Target

    dd57ab8ab44ba10bc4b7ad75a7c0c09a

  • Size

    337KB

  • Sample

    240325-f4jnpsbh8v

  • MD5

    dd57ab8ab44ba10bc4b7ad75a7c0c09a

  • SHA1

    4cdc8a22dc67a43c6c22f65296fd630659dfc6b0

  • SHA256

    0ea726a56467fd2f49aaafb53dbbfee8feb1777ea4fdd1f03dd4ef860913cb53

  • SHA512

    33df0ee03f3f7ad149f7efeacc6f3a31276ac4b9fccb6e873b91d77516a038ae3dd8087aba7fe97753a3d674ad68ccb5f91a8ebc911dd1a700d4c8031f532a47

  • SSDEEP

    6144:9TQ8axlJl5nAOx2D+C7J9xdqgSd+W13WA5zXq3dHgdppUb8s/tWh:9NaxzLnX2HV0OsWAUHX8sF+

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      dd57ab8ab44ba10bc4b7ad75a7c0c09a

    • Size

      337KB

    • MD5

      dd57ab8ab44ba10bc4b7ad75a7c0c09a

    • SHA1

      4cdc8a22dc67a43c6c22f65296fd630659dfc6b0

    • SHA256

      0ea726a56467fd2f49aaafb53dbbfee8feb1777ea4fdd1f03dd4ef860913cb53

    • SHA512

      33df0ee03f3f7ad149f7efeacc6f3a31276ac4b9fccb6e873b91d77516a038ae3dd8087aba7fe97753a3d674ad68ccb5f91a8ebc911dd1a700d4c8031f532a47

    • SSDEEP

      6144:9TQ8axlJl5nAOx2D+C7J9xdqgSd+W13WA5zXq3dHgdppUb8s/tWh:9NaxzLnX2HV0OsWAUHX8sF+

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks