General

  • Target

    1be7ffe419c1bac287de46b6fcb9ac986ee8d739b4803956fc114e6edcdf98e8.exe

  • Size

    323KB

  • Sample

    240726-vpgyws1fqp

  • MD5

    13782987c9a5c4ad10e8b1383f0ac2f3

  • SHA1

    3806980775dad8044b68ce95c8cb29169ca8d72b

  • SHA256

    1be7ffe419c1bac287de46b6fcb9ac986ee8d739b4803956fc114e6edcdf98e8

  • SHA512

    453cef5bcdff5ecdd9400a0bf045ece446f8b5a7673d999840e79b0be3b7832aa677ae40fcf036ced152915ec6781bbd319af3e78fc42784ae3e5bdf1fc90d3b

  • SSDEEP

    3072:l9cCrlEZG6zE3Yc8wDvjOxmQ/q8xw1J0pSsz0GK0iRkPkNF82QuH2jYbw4mLtHGE:l9celETLTuPcz0GK0nsNv2+w4Om

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      1be7ffe419c1bac287de46b6fcb9ac986ee8d739b4803956fc114e6edcdf98e8.exe

    • Size

      323KB

    • MD5

      13782987c9a5c4ad10e8b1383f0ac2f3

    • SHA1

      3806980775dad8044b68ce95c8cb29169ca8d72b

    • SHA256

      1be7ffe419c1bac287de46b6fcb9ac986ee8d739b4803956fc114e6edcdf98e8

    • SHA512

      453cef5bcdff5ecdd9400a0bf045ece446f8b5a7673d999840e79b0be3b7832aa677ae40fcf036ced152915ec6781bbd319af3e78fc42784ae3e5bdf1fc90d3b

    • SSDEEP

      3072:l9cCrlEZG6zE3Yc8wDvjOxmQ/q8xw1J0pSsz0GK0iRkPkNF82QuH2jYbw4mLtHGE:l9celETLTuPcz0GK0nsNv2+w4Om

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Peripheral Device Discovery

1
T1120

Tasks