General

  • Target

    7a0d1c9e0a2dc3ec461dcf06e1594bba4f0a99b8378fcfcc9b33d6951c5a6c98

  • Size

    318KB

  • Sample

    240626-a6q8nsxajp

  • MD5

    7b167a01f50c7fb6f253e104c7e54266

  • SHA1

    41c03383002fb7c8b32c7ad3bdbc7e2569ead83b

  • SHA256

    7a0d1c9e0a2dc3ec461dcf06e1594bba4f0a99b8378fcfcc9b33d6951c5a6c98

  • SHA512

    ea54c58ac06f34bed9ad0a7c2c088b37e9741895a82061bde443ea74808cf6c60452e5bc14545e43b0b7cfaae1054f86378b3a3ff7503864186f38fcb9931b4b

  • SSDEEP

    6144:6UzicKsfwzUy7Yiro9za0SwqZeNCPIhq+pteQVrLvmgQavC:dzicRfwzLinbCPIhq+pteQpvC

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      7a0d1c9e0a2dc3ec461dcf06e1594bba4f0a99b8378fcfcc9b33d6951c5a6c98

    • Size

      318KB

    • MD5

      7b167a01f50c7fb6f253e104c7e54266

    • SHA1

      41c03383002fb7c8b32c7ad3bdbc7e2569ead83b

    • SHA256

      7a0d1c9e0a2dc3ec461dcf06e1594bba4f0a99b8378fcfcc9b33d6951c5a6c98

    • SHA512

      ea54c58ac06f34bed9ad0a7c2c088b37e9741895a82061bde443ea74808cf6c60452e5bc14545e43b0b7cfaae1054f86378b3a3ff7503864186f38fcb9931b4b

    • SSDEEP

      6144:6UzicKsfwzUy7Yiro9za0SwqZeNCPIhq+pteQVrLvmgQavC:dzicRfwzLinbCPIhq+pteQpvC

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks