General

  • Target

    55ece63490ecbd138aad1982af9ef372_JaffaCakes118

  • Size

    338KB

  • Sample

    240718-dprdwssfnm

  • MD5

    55ece63490ecbd138aad1982af9ef372

  • SHA1

    5197e25d0b56e424a75d0adca50999bf80cebef3

  • SHA256

    960afdecafc94053f6da4bf4514f0922a9130db64a3edfb41884404b397886ba

  • SHA512

    e3d7aad0ec138d111db8707f8ba4a95c90bbafdee13003274bc08bcc32c0d842543d90c924a271c0822e570ae6c0a2827b58b92e56edb69d2055172e40cafd63

  • SSDEEP

    3072:pmjTKNQnR0r8FIwQBNjXnAg0FuGksqiMo3PHlzPX4XeOE6kl29vxCFb14tGKbu2z:pATKsRk8g5nAOreFaJEh2DWqG8UE

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      55ece63490ecbd138aad1982af9ef372_JaffaCakes118

    • Size

      338KB

    • MD5

      55ece63490ecbd138aad1982af9ef372

    • SHA1

      5197e25d0b56e424a75d0adca50999bf80cebef3

    • SHA256

      960afdecafc94053f6da4bf4514f0922a9130db64a3edfb41884404b397886ba

    • SHA512

      e3d7aad0ec138d111db8707f8ba4a95c90bbafdee13003274bc08bcc32c0d842543d90c924a271c0822e570ae6c0a2827b58b92e56edb69d2055172e40cafd63

    • SSDEEP

      3072:pmjTKNQnR0r8FIwQBNjXnAg0FuGksqiMo3PHlzPX4XeOE6kl29vxCFb14tGKbu2z:pATKsRk8g5nAOreFaJEh2DWqG8UE

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks