General

  • Target

    0b896f792f143fa46c38877e9a13c568_JaffaCakes118

  • Size

    314KB

  • Sample

    241002-tsk92syhrf

  • MD5

    0b896f792f143fa46c38877e9a13c568

  • SHA1

    03ffcb589735a501662839857c7fccdd4a76b3fc

  • SHA256

    01808b84c75811636237864b15b7ca13c089cd1a520dc397f51034ee8d6624c2

  • SHA512

    86baaee06ebf3b8685519f42af0647c91939e5186f7f8b3df16b20f46e0ce936b1b23cd1dfcbd4ab5ef3f75172e05e94087e9c8a646e070c065c2360c9114656

  • SSDEEP

    6144:MCHhEj4pdQuVlxbxLtrvA+zZ0NLkfBua2e:MCBEMpdrLVJzuNAb

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      0b896f792f143fa46c38877e9a13c568_JaffaCakes118

    • Size

      314KB

    • MD5

      0b896f792f143fa46c38877e9a13c568

    • SHA1

      03ffcb589735a501662839857c7fccdd4a76b3fc

    • SHA256

      01808b84c75811636237864b15b7ca13c089cd1a520dc397f51034ee8d6624c2

    • SHA512

      86baaee06ebf3b8685519f42af0647c91939e5186f7f8b3df16b20f46e0ce936b1b23cd1dfcbd4ab5ef3f75172e05e94087e9c8a646e070c065c2360c9114656

    • SSDEEP

      6144:MCHhEj4pdQuVlxbxLtrvA+zZ0NLkfBua2e:MCBEMpdrLVJzuNAb

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks