General

  • Target

    MDE_File_Sample_e6720f3976fde93f1d8fe8694ecbfd1176aa8eea.zip

  • Size

    202KB

  • Sample

    240730-ezwxsstgrq

  • MD5

    3d7b4f285163630acea9d456eeb82155

  • SHA1

    ef793fcee7b593cd4ddad9ffcf2a4d09f6115509

  • SHA256

    a3ae3c48dc5d80d4f216f5e19cbddece880d1f31d52a6e28180dd30ba788b44e

  • SHA512

    c261beb0b74d4d44378fceeee49ed43936d68ed5437fdfb3be39ffedf09c378d63d683342f9c78d53a7a08ee0098538a9b01e7f7c1f2fdca23d7f1b5bac1973a

  • SSDEEP

    6144:MY7jRv0yDwu48pO0KqWkNakHOqY+TWAHBtw1p6DRZ+gI:X7jpZcu4C52ks3F+TWAHTwC+gI

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      Defender detected 'VirTool:Win32/CeeInject.GF!bit' in file '9bb77c4d-347e-ee27-033e-ed357f543b17.exe', during attempted open by 'cmd.exe'

    • Size

      312KB

    • MD5

      b09160e574ec1af717216b0ea05ea184

    • SHA1

      e6720f3976fde93f1d8fe8694ecbfd1176aa8eea

    • SHA256

      4a755c8ced6c11dc885b6109c8aa39686692148ace1856535f4e61f6ebfd731c

    • SHA512

      6e1028b109e44fab59761cd0a0c02b76bd354443ad21260df7572989c48930bbdb67ba725eafb85db1b83bea489b2829b67b433d3faa64dd0a056f3e44bc6595

    • SSDEEP

      6144:MkI2vN3S8eZRalDd+FkrsRoGwq9sGod1D63:0YN35kRQMFksnwAs31D

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks