General

  • Target

    6f742ded41e3a5cad4cbe74128e833f7_JaffaCakes118

  • Size

    351KB

  • Sample

    240401-mfj3wscd84

  • MD5

    6f742ded41e3a5cad4cbe74128e833f7

  • SHA1

    b4ad7977450f002093be5274a26c5c7d7d82aef0

  • SHA256

    98933c4dfb0ffa2b7ba283759dd4bcbb87d477250c7a0f8fbfcb5853f2a199cb

  • SHA512

    780aeb499b5dab64930383c80894ebc0b7b3ca1aa0283ceba50fb095dd2dbdda9d573cbc1cb1697785be45d344abc0a689f37c7ee212690bb1a178f5aab8f81d

  • SSDEEP

    6144:1BLtiT5nAO7OaW6Oqkh0QS/ec2P1NsZNefdddtFlYkl5d9hrg5iM8XRtu9gr9Yyh:VitnhOaW6OqU0QS/ecy1NsZNefdddtFB

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      6f742ded41e3a5cad4cbe74128e833f7_JaffaCakes118

    • Size

      351KB

    • MD5

      6f742ded41e3a5cad4cbe74128e833f7

    • SHA1

      b4ad7977450f002093be5274a26c5c7d7d82aef0

    • SHA256

      98933c4dfb0ffa2b7ba283759dd4bcbb87d477250c7a0f8fbfcb5853f2a199cb

    • SHA512

      780aeb499b5dab64930383c80894ebc0b7b3ca1aa0283ceba50fb095dd2dbdda9d573cbc1cb1697785be45d344abc0a689f37c7ee212690bb1a178f5aab8f81d

    • SSDEEP

      6144:1BLtiT5nAO7OaW6Oqkh0QS/ec2P1NsZNefdddtFlYkl5d9hrg5iM8XRtu9gr9Yyh:VitnhOaW6OqU0QS/ecy1NsZNefdddtFB

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks