Resubmissions

06-08-2024 04:07

240806-ep14rstapf 10

General

  • Target

    2024-08-06-11-44.zip

  • Size

    182KB

  • Sample

    240806-ep14rstapf

  • MD5

    883c514100919fa2835c13c978222206

  • SHA1

    6b14d250daf8dae3246c3ca642b064f95325165b

  • SHA256

    30a16cc9c98faf68ff7728e2c4dc22f1c7ac329fcb5138cd4b00b4ea48ab484e

  • SHA512

    afc3d7f894e2ef98400caf7c6cc5e88c5875641f85c6243bbc0014c81ffa6b373ab3f07cf10d2bad3003aec3b910cf5c209eeaf779569f2394cdde46dacb9d6d

  • SSDEEP

    3072:3O61lj/Zd0bwcxVmY7/4hC9RSb8xGsZkOJlUkOfDO7PBB2UYHqt3oKLEcnf31Osr:l1ljRAwX6whYRC8AckYKIBp6qtH1n4sr

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      dba2eaf17629982c17a22c8899d3189b4dd6536e9d164c80e2e9bd3126ad408a

    • Size

      356KB

    • MD5

      2b97cdb089c3cd1bd7dc88ff7cba562d

    • SHA1

      5d8bb419112748a9cfecfd07ec7171bcc1f16dab

    • SHA256

      dba2eaf17629982c17a22c8899d3189b4dd6536e9d164c80e2e9bd3126ad408a

    • SHA512

      8820778bf14916d2b2e000acaae4ccba907aa0227f77c45def2ba3ea1f9af69fdfee7babe24833716a49be516b4063969a068939207ddb672fd245513eb36008

    • SSDEEP

      6144:Ydw1SX3LwgoR8NdL/pCJBBRRTm7ECWZkYs17Z0SoY:Ya1SX7wnGoJBBRcSkz1ufY

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks