General

  • Target

    b09160e574ec1af717216b0ea05ea184_JaffaCakes118

  • Size

    312KB

  • Sample

    240615-21kbqascrn

  • MD5

    b09160e574ec1af717216b0ea05ea184

  • SHA1

    e6720f3976fde93f1d8fe8694ecbfd1176aa8eea

  • SHA256

    4a755c8ced6c11dc885b6109c8aa39686692148ace1856535f4e61f6ebfd731c

  • SHA512

    6e1028b109e44fab59761cd0a0c02b76bd354443ad21260df7572989c48930bbdb67ba725eafb85db1b83bea489b2829b67b433d3faa64dd0a056f3e44bc6595

  • SSDEEP

    6144:MkI2vN3S8eZRalDd+FkrsRoGwq9sGod1D63:0YN35kRQMFksnwAs31D

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      b09160e574ec1af717216b0ea05ea184_JaffaCakes118

    • Size

      312KB

    • MD5

      b09160e574ec1af717216b0ea05ea184

    • SHA1

      e6720f3976fde93f1d8fe8694ecbfd1176aa8eea

    • SHA256

      4a755c8ced6c11dc885b6109c8aa39686692148ace1856535f4e61f6ebfd731c

    • SHA512

      6e1028b109e44fab59761cd0a0c02b76bd354443ad21260df7572989c48930bbdb67ba725eafb85db1b83bea489b2829b67b433d3faa64dd0a056f3e44bc6595

    • SSDEEP

      6144:MkI2vN3S8eZRalDd+FkrsRoGwq9sGod1D63:0YN35kRQMFksnwAs31D

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks