General

  • Target

    2024-08-28_4456a66f751d7cbfcbdcbd5ae7bdb3eb_icedid

  • Size

    1.9MB

  • Sample

    240828-1ncwfaxfqh

  • MD5

    4456a66f751d7cbfcbdcbd5ae7bdb3eb

  • SHA1

    e544b44de51df69081bc1abda013b3f6cc41c01e

  • SHA256

    0950611d0e13baa6f08cc3a0d3155adcadb66873516aaa877e700b75e956f822

  • SHA512

    0242a470fcc67a27ccba2c3adb00836684475f49ddfae96970b736642e90bdfff26b6b07952427df4f0a6578b8f1b94b41453462d9a3f40dbf7f7933beaf7c74

  • SSDEEP

    24576:dzTsM7XmuHjvbS88AKnues7SMpF6zE+UuXZiJZpHfN0blDvkSlp9uC:d3DjS3BXIJL6DR8C

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ashfkwu.ru:9821

yekfhsh.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      2024-08-28_4456a66f751d7cbfcbdcbd5ae7bdb3eb_icedid

    • Size

      1.9MB

    • MD5

      4456a66f751d7cbfcbdcbd5ae7bdb3eb

    • SHA1

      e544b44de51df69081bc1abda013b3f6cc41c01e

    • SHA256

      0950611d0e13baa6f08cc3a0d3155adcadb66873516aaa877e700b75e956f822

    • SHA512

      0242a470fcc67a27ccba2c3adb00836684475f49ddfae96970b736642e90bdfff26b6b07952427df4f0a6578b8f1b94b41453462d9a3f40dbf7f7933beaf7c74

    • SSDEEP

      24576:dzTsM7XmuHjvbS88AKnues7SMpF6zE+UuXZiJZpHfN0blDvkSlp9uC:d3DjS3BXIJL6DR8C

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks