General

  • Target

    825ce530beffbdebc7c6fc107541372d_JaffaCakes118

  • Size

    444KB

  • Sample

    241031-jq1a3svrdl

  • MD5

    825ce530beffbdebc7c6fc107541372d

  • SHA1

    ad56772746d475a6df53ea319d1584e5c98f8d8f

  • SHA256

    f141d5f77d7865789b92e8ebff3535c91a1d007537962378e213abd958d7b066

  • SHA512

    6f7bd2296420227a945180cb6b42807be3d839ef63cddd2854b3af24dd0330308c6749778ac534d33f6a3a8174c6691b611d53c489b9d86013639ed77d13bb3c

  • SSDEEP

    6144:BkMHZdHAO126eKThZi1kzi09pxiDMU7O:5ZdHb269biy3UDMf

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      825ce530beffbdebc7c6fc107541372d_JaffaCakes118

    • Size

      444KB

    • MD5

      825ce530beffbdebc7c6fc107541372d

    • SHA1

      ad56772746d475a6df53ea319d1584e5c98f8d8f

    • SHA256

      f141d5f77d7865789b92e8ebff3535c91a1d007537962378e213abd958d7b066

    • SHA512

      6f7bd2296420227a945180cb6b42807be3d839ef63cddd2854b3af24dd0330308c6749778ac534d33f6a3a8174c6691b611d53c489b9d86013639ed77d13bb3c

    • SSDEEP

      6144:BkMHZdHAO126eKThZi1kzi09pxiDMU7O:5ZdHb269biy3UDMf

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks