Extracted

• • Target

    ex.gif

  • Size

    367KB

  • MD5

    01a6a316bacd726134bdec900b2511c5

  • SHA1

    4d66a5cd128cb21b48d2d8acc5c5b3fb6343373b

  • SHA256

    325493202601e5f9c362eb916422f8d6dfa367339b4801c62eef6ba8ac972838

  • SHA512

    13f742691f953f1d6df20cf3188cc706e30691603d09ec7bc1882c028dfedfb2df3d5dde0363c93e5f92be1b664a3763f226ef6ece0b35d196b2db20bf491804

  • SSDEEP

    6144:5TeWTE1rkt826L4xd1EiftWt6empEVZlVISrt5AuK+FkkvECKCJdQWo2:5TbTE1rkt826L4xd1EiEt6empQ+uK+uQ

  Score

  10^/10

  mylobotbotnetdiscoverypersistence

  • Mylobot

    Botnet which first appeared in 2017 written in C++.

    botnetmylobot

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1