General

  • Target

    5923300752.zip

  • Size

    342KB

  • Sample

    240625-bhqsnsvhnj

  • MD5

    09a8bf4701371b29b83e23baba3562da

  • SHA1

    c567a1e75d80e3b3c1912583dde2e66043dc0195

  • SHA256

    5d7c9e29d113af988feb31e84eeed9c1a95b00d39dd4db5a2329e66e2fa753e5

  • SHA512

    9a148f954097984cabdea75885bcd7e936a593c6965b692e44b336f349cc5415aa35c02b86fa27f238ea9506736350584748473a3d42163e9388c24b6af93bcc

  • SSDEEP

    6144:8Y+ZYuKovesw2dOIVvjiYJY5sickB84tUGG+mKdGOb2/8ogCrB6uYELxTTz4n2WY:Q6hovesZVvjryBB2GS+/dGObzCrBR42l

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      5923300752

    • Size

      576KB

    • MD5

      b7c0532bbda3d6971f32e453a394e74b

    • SHA1

      0e5752144c3e16baff466a34e1042cd92e8eed05

    • SHA256

      1743e0b47cdfe56ab18b3f5508debc3c5af598b3db436286d4d3a6d9f14aec0c

    • SHA512

      97a2203bdc137f49dbff4b6f5876a0d50f58b37fd14b9ab37e70ff5c60a7fff2a63483576d6496180327a94ffb08708d089cd04c93444bcbcf9c82c8ce3acb59

    • SSDEEP

      12288:/xbTE1rkt826L4xd1EiEt6empQ+uK+8k6KlMv+LLiJyr5PSiApJCYS/:/x818EiYTmp7kHizJyhZApJY

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks