General

  • Target

    9c47cd82.exe

  • Size

    284KB

  • Sample

    240512-nh6kcacg7y

  • MD5

    add07689c5b49b370081d3872d610696

  • SHA1

    ce0001c8b21cd23f66eb401c2f09f5347c743ac6

  • SHA256

    4e812c0035be66b12f3bfed4aea833e51badac0f938051c5e3bd88aa31c5816d

  • SHA512

    46c7c0b9a8f1ba7608c9b3eb73d67a333dd7bbd8f75f155bdf27c8c8d08e2cf8ae42b29e5542ef2915669a37637fca6bf9178eae541123a42d63f774a0b66372

  • SSDEEP

    6144:L5wTHwhi1uOD7sFhh/t+M32CuFrPUDwIFucurrKO:L5wTQouk7sFHt+M2CuFrPUsfcDO

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      9c47cd82.exe

    • Size

      284KB

    • MD5

      add07689c5b49b370081d3872d610696

    • SHA1

      ce0001c8b21cd23f66eb401c2f09f5347c743ac6

    • SHA256

      4e812c0035be66b12f3bfed4aea833e51badac0f938051c5e3bd88aa31c5816d

    • SHA512

      46c7c0b9a8f1ba7608c9b3eb73d67a333dd7bbd8f75f155bdf27c8c8d08e2cf8ae42b29e5542ef2915669a37637fca6bf9178eae541123a42d63f774a0b66372

    • SSDEEP

      6144:L5wTHwhi1uOD7sFhh/t+M32CuFrPUDwIFucurrKO:L5wTQouk7sFHt+M2CuFrPUsfcDO

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks