General

  • Target

    18166606328.zip

  • Size

    188KB

  • Sample

    240711-b868cascnj

  • MD5

    3a8687d9c48dd1de6c3273c5fbcd04ee

  • SHA1

    65b2cfcd0a34cbc495322223a7e3fff084ec188a

  • SHA256

    703fc56f30aa1c1bd9ff1df3dcc5245b25d64bdcc51afb7add3f4b71b4728c9e

  • SHA512

    b63af92d6c56d57eda526329814bbffabde3e7377f87819ef7bf8359ff19cdd4653bc066486761a6b9c3f96316fa5a24c6d54375d5c5f770464a32e9cc03dc62

  • SSDEEP

    3072:ez9C/OfV3Hnhv5y/XIoUoDYFKz9L3URowqVWMQiLRJ08aNxJNH0npga/VslDx2q2:W8OfxC/d2FKx+iOYDzeHbamz2q3V1BCv

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ashfkwu.ru:9821

pomplus.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbx.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      342cbfa05aa7fba5a26ed5c4f9f8e81071da4bc5cf50d808375031c5d83e9545

    • Size

      261KB

    • MD5

      4dbc34f3a10b70922d9f73588af4b7df

    • SHA1

      c3278bfb34f61d57d5de01cd431ec236da8d3572

    • SHA256

      342cbfa05aa7fba5a26ed5c4f9f8e81071da4bc5cf50d808375031c5d83e9545

    • SHA512

      15b29ca36ce26c7a4cf9a653590405ee903fa3a22dfc050cabc9a4ca09f653825c073689bb05e06f7b67652be418184d7a0967fd49e72109a01a414a2e070b0e

    • SSDEEP

      3072:1hf5y7kBz6QWvqsCG7KVy1Yl2YogrQ2BGUqMXKRBhNZcMSENt7:KqCqPiOy6l2X2A7c6ZFNF

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks