General

  • Target

    f5cc1d9481b083729a87c262304250ac_JaffaCakes118

  • Size

    340KB

  • Sample

    240925-me9bdszfkr

  • MD5

    f5cc1d9481b083729a87c262304250ac

  • SHA1

    9c964dc6f614e4b2d995660da2e98682ca7b4912

  • SHA256

    1277d25e1c2edaaf19d89afa71c64057425c3f13914bc4d1474d7d6d76cc0628

  • SHA512

    c860ef508080bcdb296a9b9d697007fb44a86ada11276c83eb2a362b6a3d7ddbc89acbdb5ffd09af1b77ba6f4dfafe46c648f8dcd6e5607aa8d1d5e1e00edf74

  • SSDEEP

    6144:hjz5EwxAQ5nAOpngFnhOCZUBD94JNemDJKk5nkgesTd:hJEwxAOn7grOeZJNemDJKk5nkaTd

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      f5cc1d9481b083729a87c262304250ac_JaffaCakes118

    • Size

      340KB

    • MD5

      f5cc1d9481b083729a87c262304250ac

    • SHA1

      9c964dc6f614e4b2d995660da2e98682ca7b4912

    • SHA256

      1277d25e1c2edaaf19d89afa71c64057425c3f13914bc4d1474d7d6d76cc0628

    • SHA512

      c860ef508080bcdb296a9b9d697007fb44a86ada11276c83eb2a362b6a3d7ddbc89acbdb5ffd09af1b77ba6f4dfafe46c648f8dcd6e5607aa8d1d5e1e00edf74

    • SSDEEP

      6144:hjz5EwxAQ5nAOpngFnhOCZUBD94JNemDJKk5nkgesTd:hJEwxAOn7grOeZJNemDJKk5nkaTd

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks