Overview

overview

10

Static

static

3

125aba1f44...18.exe

windows7-x64

10

125aba1f44...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    125aba1f44c03c2ee8df9061c998d1c3_JaffaCakes118

  • Size

    176KB

  • Sample

    240504-mqjvwaeb84

  • MD5

    125aba1f44c03c2ee8df9061c998d1c3

  • SHA1

    fe1072140eba2dcde0d5d869c11ec59fbf9e5317

  • SHA256

    864714b07f356d95707a69f4ca175ab6be18f54b6d2d4eaddbbd6103c141abe1

  • SHA512

    d258a3048635a1058c4500a5d5a15bc85c6e403aab45b7b28a2c48a86108bac5ba78883886f1b84706d36e3ceb1652a5d10ed7d4b40aa71542323165f1eb53d5

  • SSDEEP

    3072:2f5pYXST6pgLOyc/J8jNuoztLlieHX9a7gtE20aKW48wiYQb3D:5ST6pYOBR8NuoJL0eN77KW48wpu

Score
10/10
mylobotbotnetpersistence

Malware Config

Extracted

Family

mylobot

C2

fywkuzp.ru:7432

zdrussle.ru:2173

pseyumd.ru:5492

stydodo.ru:2619

tqzknrx.com:1123

mdcqrxw.com:4984

tpwtgyw.com:9631

cnoyucn.com:9426

qhloury.com:4759

fnjxpwy.com:3863

csxpzlz.com:5778

wlkjopy.com:8778

mynfwwk.com:8427

uuitwxg.com:6656

agnxomu.com:8881

wcagsib.com:3547

fmniltb.com:9582

oapwxiu.com:3922

petrrry.com:7531

poubauo.com:4623

Targets

    • Target

      125aba1f44c03c2ee8df9061c998d1c3_JaffaCakes118

    • Size

      176KB

    • MD5

      125aba1f44c03c2ee8df9061c998d1c3

    • SHA1

      fe1072140eba2dcde0d5d869c11ec59fbf9e5317

    • SHA256

      864714b07f356d95707a69f4ca175ab6be18f54b6d2d4eaddbbd6103c141abe1

    • SHA512

      d258a3048635a1058c4500a5d5a15bc85c6e403aab45b7b28a2c48a86108bac5ba78883886f1b84706d36e3ceb1652a5d10ed7d4b40aa71542323165f1eb53d5

    • SSDEEP

      3072:2f5pYXST6pgLOyc/J8jNuoztLlieHX9a7gtE20aKW48wiYQb3D:5ST6pYOBR8NuoJL0eN77KW48wpu

    Score
    10/10
    mylobotbotnetpersistence

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

      botnetmylobot

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks