General

  • Target

    b96fa13c4f32a104351f85ea16e16eb0_JaffaCakes118

  • Size

    340KB

  • Sample

    240822-263p9avfjk

  • MD5

    b96fa13c4f32a104351f85ea16e16eb0

  • SHA1

    33f808bce2b76b1cb8091502b2b6fbddc2dbcccf

  • SHA256

    61b4c6a9fd4597ba45911dabb156b08379ec07abd66c183ad275171d280469a0

  • SHA512

    8a5196404e863d9e99dc1ba3ad1f348727aa2a7be668fcf9341c86be6a162fb8accff6e9c8b7e237eeb4d939d8abfb5bcd071bf762019d1f77193e242456d55c

  • SSDEEP

    6144:0gu1ICZ5nAON1GaolxWQr3oz4NQHnpaZDZVu4SaRXlI/aYBWhnLe8ytKYn8j9Bbz:0gTCnnJGtWUo0qHnpaZDZVu4SaRXlI/4

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      b96fa13c4f32a104351f85ea16e16eb0_JaffaCakes118

    • Size

      340KB

    • MD5

      b96fa13c4f32a104351f85ea16e16eb0

    • SHA1

      33f808bce2b76b1cb8091502b2b6fbddc2dbcccf

    • SHA256

      61b4c6a9fd4597ba45911dabb156b08379ec07abd66c183ad275171d280469a0

    • SHA512

      8a5196404e863d9e99dc1ba3ad1f348727aa2a7be668fcf9341c86be6a162fb8accff6e9c8b7e237eeb4d939d8abfb5bcd071bf762019d1f77193e242456d55c

    • SSDEEP

      6144:0gu1ICZ5nAON1GaolxWQr3oz4NQHnpaZDZVu4SaRXlI/aYBWhnLe8ytKYn8j9Bbz:0gTCnnJGtWUo0qHnpaZDZVu4SaRXlI/4

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks