General

  • Target

    e0132b1fb17e9dd5d7150ff3e12cbe9822e3b35ba7c53321abc19a1948e61264.exe

  • Size

    351KB

  • Sample

    240524-k5nfhacb7s

  • MD5

    6da5178600f70b4ddb084c799634a8e2

  • SHA1

    852efad92b42b2c6a047a7c360799ee896876b03

  • SHA256

    e0132b1fb17e9dd5d7150ff3e12cbe9822e3b35ba7c53321abc19a1948e61264

  • SHA512

    fdf0b33969550a34594027fde3a40a77d4b5e12f7a0c0a4003452a70a45ef930c5a4715f86a5710e90d067ae527c2ec07be0504199681982af48212f9253b40d

  • SSDEEP

    3072:BSapEWxk4/mr7ewFBNX+wks6RVUTtpZ9Fy4ZqDxNvFeIs0cbGKvP5tJEF3gHeSQ0:cWx3MEt4MxVreIdcbGUP5IF3g+Yb9qfu

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      e0132b1fb17e9dd5d7150ff3e12cbe9822e3b35ba7c53321abc19a1948e61264.exe

    • Size

      351KB

    • MD5

      6da5178600f70b4ddb084c799634a8e2

    • SHA1

      852efad92b42b2c6a047a7c360799ee896876b03

    • SHA256

      e0132b1fb17e9dd5d7150ff3e12cbe9822e3b35ba7c53321abc19a1948e61264

    • SHA512

      fdf0b33969550a34594027fde3a40a77d4b5e12f7a0c0a4003452a70a45ef930c5a4715f86a5710e90d067ae527c2ec07be0504199681982af48212f9253b40d

    • SSDEEP

      3072:BSapEWxk4/mr7ewFBNX+wks6RVUTtpZ9Fy4ZqDxNvFeIs0cbGKvP5tJEF3gHeSQ0:cWx3MEt4MxVreIdcbGUP5IF3g+Yb9qfu

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks