General

  • Target

    b0ed157e955a9d99d9506ba506d7b3e5_JaffaCakes118

  • Size

    334KB

  • Sample

    240820-1fe1tsybnp

  • MD5

    b0ed157e955a9d99d9506ba506d7b3e5

  • SHA1

    9a0a93c0896684a4847829bafaf6b9fb3c2bb802

  • SHA256

    0185bb02e409f9eca3add5b013b0b94abd20baaac77e2b896b3991b56926d836

  • SHA512

    202cdb0a85f49a465c0df24a212964aaaa9a6c3efb3adc78f85972a9f75c6197f74795767f0f709d9d6847c4fd6a4d1127f3722bd8263d5ba9c3eed821029997

  • SSDEEP

    3072:hKLgUl52ObRdGPwqBNjXnAg0FuekstIhDNgtiuMDU3LyHY4t65uH+SIRmJSyFReD:hsF5nbzI5nAOT9L3U3oYo65unFJSGiv

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      b0ed157e955a9d99d9506ba506d7b3e5_JaffaCakes118

    • Size

      334KB

    • MD5

      b0ed157e955a9d99d9506ba506d7b3e5

    • SHA1

      9a0a93c0896684a4847829bafaf6b9fb3c2bb802

    • SHA256

      0185bb02e409f9eca3add5b013b0b94abd20baaac77e2b896b3991b56926d836

    • SHA512

      202cdb0a85f49a465c0df24a212964aaaa9a6c3efb3adc78f85972a9f75c6197f74795767f0f709d9d6847c4fd6a4d1127f3722bd8263d5ba9c3eed821029997

    • SSDEEP

      3072:hKLgUl52ObRdGPwqBNjXnAg0FuekstIhDNgtiuMDU3LyHY4t65uH+SIRmJSyFReD:hsF5nbzI5nAOT9L3U3oYo65unFJSGiv

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks