General

  • Target

    31db397f4baef880177fab9125dbfa20_NeikiAnalytics

  • Size

    281KB

  • Sample

    240510-3wc8aabg65

  • MD5

    31db397f4baef880177fab9125dbfa20

  • SHA1

    afa31ade126b11f3270cee6bc7a8b8cd4bd38a95

  • SHA256

    91bd19fd2534d18bb3abfc10cc431fb6087a1820c313d585d266bf51f45932ef

  • SHA512

    d67aa87ebbe5d0da9034a6d76d64ffb1252a6e54f445ad19ba7f6de13e84191f89b7e4d19efc10817b10437d4aad71f086a707719422dfba74589e350f468a54

  • SSDEEP

    6144:hL5lv6vP31dHOx1RhQx5car5yHH/JNJ25Ij1dkj:hLLvg9dHOxF8r50Jpfkj

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      31db397f4baef880177fab9125dbfa20_NeikiAnalytics

    • Size

      281KB

    • MD5

      31db397f4baef880177fab9125dbfa20

    • SHA1

      afa31ade126b11f3270cee6bc7a8b8cd4bd38a95

    • SHA256

      91bd19fd2534d18bb3abfc10cc431fb6087a1820c313d585d266bf51f45932ef

    • SHA512

      d67aa87ebbe5d0da9034a6d76d64ffb1252a6e54f445ad19ba7f6de13e84191f89b7e4d19efc10817b10437d4aad71f086a707719422dfba74589e350f468a54

    • SSDEEP

      6144:hL5lv6vP31dHOx1RhQx5car5yHH/JNJ25Ij1dkj:hLLvg9dHOxF8r50Jpfkj

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks