General

  • Target

    f7ba9baf-82b3-546b-222c-2f2551e2f1da.exe

  • Size

    312KB

  • Sample

    240905-dnecyasapl

  • MD5

    bfef91bacc33b5424ea2a40245fd9039

  • SHA1

    a9c60eb8dabc24b04eaf99c3c613f6d5c1a19b41

  • SHA256

    f2bae4d8912682525ecd787fb921c3b57d8672c44ea73eb23c0ab278cf1fb939

  • SHA512

    19de586b1ec80cabd40d78e02e7cd8f5d868c9a907433dc9b6fb16747157d4a613d17cad43e249841cb841b0838bd33cf15eb413d8510f62975ef6c0b24ff2e3

  • SSDEEP

    6144:kn9+9wPbNTK0Q/fvzKZ62jY/776KOWu/GduR9swnApRTv+:k9RTG/fvyLj472KOv/GduzsJpRq

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Targets

    • Target

      f7ba9baf-82b3-546b-222c-2f2551e2f1da.exe

    • Size

      312KB

    • MD5

      bfef91bacc33b5424ea2a40245fd9039

    • SHA1

      a9c60eb8dabc24b04eaf99c3c613f6d5c1a19b41

    • SHA256

      f2bae4d8912682525ecd787fb921c3b57d8672c44ea73eb23c0ab278cf1fb939

    • SHA512

      19de586b1ec80cabd40d78e02e7cd8f5d868c9a907433dc9b6fb16747157d4a613d17cad43e249841cb841b0838bd33cf15eb413d8510f62975ef6c0b24ff2e3

    • SSDEEP

      6144:kn9+9wPbNTK0Q/fvzKZ62jY/776KOWu/GduR9swnApRTv+:k9RTG/fvyLj472KOv/GduzsJpRq

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks