General

  • Target

    08b53ce724ee7b7a0cb53213dcc3ec81_JaffaCakes118

  • Size

    308KB

  • Sample

    240328-sffncsab64

  • MD5

    08b53ce724ee7b7a0cb53213dcc3ec81

  • SHA1

    40bc2d073183dc18c4e69ea4c50446b2d39f5587

  • SHA256

    35b99b44e8bff0ba86d4748a5b5c6e96836858e789eea8bb30439bc377fdaf67

  • SHA512

    46119e6af27225ff5870c53734fe9b501b076b316cf536fbdf00bf96363c01713a484d9045811ed86b51d67f3e8065ac861c01df29aa099e8a3596769471b169

  • SSDEEP

    3072:W50kHTAgQ6bPBtczP6wDGqsrzCvovAh7ytESMRAdwvE+CqphMNbUayY3NamBSv:20kH8gQeA1SEAWPMNxyc9BS

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      08b53ce724ee7b7a0cb53213dcc3ec81_JaffaCakes118

    • Size

      308KB

    • MD5

      08b53ce724ee7b7a0cb53213dcc3ec81

    • SHA1

      40bc2d073183dc18c4e69ea4c50446b2d39f5587

    • SHA256

      35b99b44e8bff0ba86d4748a5b5c6e96836858e789eea8bb30439bc377fdaf67

    • SHA512

      46119e6af27225ff5870c53734fe9b501b076b316cf536fbdf00bf96363c01713a484d9045811ed86b51d67f3e8065ac861c01df29aa099e8a3596769471b169

    • SSDEEP

      3072:W50kHTAgQ6bPBtczP6wDGqsrzCvovAh7ytESMRAdwvE+CqphMNbUayY3NamBSv:20kH8gQeA1SEAWPMNxyc9BS

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks