General

  • Target

    5000c92f63a8d00541a993e88f10da1e_JaffaCakes118

  • Size

    296KB

  • Sample

    241017-bcehfstarg

  • MD5

    5000c92f63a8d00541a993e88f10da1e

  • SHA1

    04bee167faca6dc8bd2363513c7cec9073405a8b

  • SHA256

    9f28b3811c4b1e2f96380a3f318bfb273f6b00db89d89623ce727ceecfba9f2a

  • SHA512

    c7b4dcde8e9de2514520c8d09c136797b022c2bdc385b30f3d7acbc016bbf7f5e19195399440aa9e31e237d5d0fbf5ccdc03fbbd667041263b70c9841770e08b

  • SSDEEP

    3072:JHBXjAJM1Qorw2nE/PmmyAY1VHYCdD43fJLRZaimmwBRspAdM1bg0+SElYhfPZ3h:JlEMbmZYHYuD6flaFwsFkhn

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      5000c92f63a8d00541a993e88f10da1e_JaffaCakes118

    • Size

      296KB

    • MD5

      5000c92f63a8d00541a993e88f10da1e

    • SHA1

      04bee167faca6dc8bd2363513c7cec9073405a8b

    • SHA256

      9f28b3811c4b1e2f96380a3f318bfb273f6b00db89d89623ce727ceecfba9f2a

    • SHA512

      c7b4dcde8e9de2514520c8d09c136797b022c2bdc385b30f3d7acbc016bbf7f5e19195399440aa9e31e237d5d0fbf5ccdc03fbbd667041263b70c9841770e08b

    • SSDEEP

      3072:JHBXjAJM1Qorw2nE/PmmyAY1VHYCdD43fJLRZaimmwBRspAdM1bg0+SElYhfPZ3h:JlEMbmZYHYuD6flaFwsFkhn

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks