Overview

overview

10

Static

static

3

0f3c0cb541...18.exe

windows7-x64

10

0f3c0cb541...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f3c0cb5410b296f4b29be4c800ad777_JaffaCakes118

  • Size

    176KB

  • Sample

    240503-anvs5scd23

  • MD5

    0f3c0cb5410b296f4b29be4c800ad777

  • SHA1

    c37268de787a8052a23b7c8e0077e9ae18c48ba7

  • SHA256

    27b7db764f7d776bbdb97a8f028c37d3ce5ba0c9a0bdcad3cdd0da72f8110117

  • SHA512

    33cb799df16432bfa71fbbd80afd0a838ecf8da6870747ce537e65b4bedfba02936a39f1fe26972b7261aeb8cd8b428fd421d6a1327ae69c3432982b31ea9e6c

  • SSDEEP

    3072:Uf53PUde78PdCRzG1TeA/i5WkYXu2f4UYL5i2HXeBzyoJNAOrVG:Cce8gG1TeB5R4u/3eworU

Score
10/10
mylobotbotnetpersistence

Malware Config

Extracted

Family

mylobot

C2

fywkuzp.ru:7432

zdrussle.ru:2173

pseyumd.ru:5492

stydodo.ru:2619

tqzknrx.com:1123

mdcqrxw.com:4984

tpwtgyw.com:9631

cnoyucn.com:9426

qhloury.com:4759

fnjxpwy.com:3863

csxpzlz.com:5778

wlkjopy.com:8778

mynfwwk.com:8427

uuitwxg.com:6656

agnxomu.com:8881

wcagsib.com:3547

fmniltb.com:9582

oapwxiu.com:3922

petrrry.com:7531

poubauo.com:4623

Targets

    • Target

      0f3c0cb5410b296f4b29be4c800ad777_JaffaCakes118

    • Size

      176KB

    • MD5

      0f3c0cb5410b296f4b29be4c800ad777

    • SHA1

      c37268de787a8052a23b7c8e0077e9ae18c48ba7

    • SHA256

      27b7db764f7d776bbdb97a8f028c37d3ce5ba0c9a0bdcad3cdd0da72f8110117

    • SHA512

      33cb799df16432bfa71fbbd80afd0a838ecf8da6870747ce537e65b4bedfba02936a39f1fe26972b7261aeb8cd8b428fd421d6a1327ae69c3432982b31ea9e6c

    • SSDEEP

      3072:Uf53PUde78PdCRzG1TeA/i5WkYXu2f4UYL5i2HXeBzyoJNAOrVG:Cce8gG1TeB5R4u/3eworU

    Score
    10/10
    mylobotbotnetpersistence

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

      botnetmylobot

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks