General

  • Target

    ab4124bef72bb5dfb58603cb229106e03dd58a259c6839af63b273d1f77ebf05

  • Size

    316KB

  • Sample

    240411-bzsctsgg65

  • MD5

    26b31b051b4e354313f88c8c7bc5e03b

  • SHA1

    9211d41c599a52239b7a3393568bb59f73c0e81c

  • SHA256

    ab4124bef72bb5dfb58603cb229106e03dd58a259c6839af63b273d1f77ebf05

  • SHA512

    6da6f4a4049256b5af0c490a83cf85d966d80e4608772d562e628e8005c1b8eb4e16b27d62fcc5afd4478784abebe039040cafb8d665f3af8bd283dbc405dd84

  • SSDEEP

    6144:/SEpctXkMaKiQFWxcb1eSkY3Pr7GTSR1/j6+:/SAsXHECWxjmzESR9j6+

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      ab4124bef72bb5dfb58603cb229106e03dd58a259c6839af63b273d1f77ebf05

    • Size

      316KB

    • MD5

      26b31b051b4e354313f88c8c7bc5e03b

    • SHA1

      9211d41c599a52239b7a3393568bb59f73c0e81c

    • SHA256

      ab4124bef72bb5dfb58603cb229106e03dd58a259c6839af63b273d1f77ebf05

    • SHA512

      6da6f4a4049256b5af0c490a83cf85d966d80e4608772d562e628e8005c1b8eb4e16b27d62fcc5afd4478784abebe039040cafb8d665f3af8bd283dbc405dd84

    • SSDEEP

      6144:/SEpctXkMaKiQFWxcb1eSkY3Pr7GTSR1/j6+:/SAsXHECWxjmzESR9j6+

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Tasks