General

  • Target

    0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65

  • Size

    369KB

  • Sample

    240625-3j2p4szhqb

  • MD5

    de50b55b849ac32363ef3f39d450dd6e

  • SHA1

    8f1e8ab32ad0ff404519ffd9431af8f22a027050

  • SHA256

    0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65

  • SHA512

    df317637424bd6a07f080d8a496ea567bebf6348d805f2846bc25326a1ae83a80c57f39dcf82d289498fdcc858b6bcfb2c838417fb7252032099dd98f3097be0

  • SSDEEP

    6144:kn9+9wPbNTK0Q/fvzKZ62jY/776KOWu/GduR9swnApRTvgJAbUYL7j:k9RTG/fvyLj472KOv/GduzsJpRvbT

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Targets

    • Target

      0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65

    • Size

      369KB

    • MD5

      de50b55b849ac32363ef3f39d450dd6e

    • SHA1

      8f1e8ab32ad0ff404519ffd9431af8f22a027050

    • SHA256

      0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65

    • SHA512

      df317637424bd6a07f080d8a496ea567bebf6348d805f2846bc25326a1ae83a80c57f39dcf82d289498fdcc858b6bcfb2c838417fb7252032099dd98f3097be0

    • SSDEEP

      6144:kn9+9wPbNTK0Q/fvzKZ62jY/776KOWu/GduR9swnApRTvgJAbUYL7j:k9RTG/fvyLj472KOv/GduzsJpRvbT

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks