General

  • Target

    ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

  • Size

    404KB

  • Sample

    241112-hrvasaxekb

  • MD5

    f0f8b2044aedfe2be5ca3edcf7d1c05d

  • SHA1

    c0b72e6051824c07ee232e30cbb3aad78f05b91f

  • SHA256

    ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

  • SHA512

    d76b82f39fcc5a02673cb1bdcc2c7f24bbe056ee56900ca596d1c808593ed51ad09b787ab5897bdd3b0cfcf2ba3aa873dc4010737711f568571de6e8fcd27cad

  • SSDEEP

    3072:AASbgLok6IxenO3EfOT8ApeGMp2UYvTYiiVzfHxke7xrZGqATPZDzjr4DmxpmJlB:Adb6cO3EfOYApkKbY7Vzy2rqKSPAQB8l

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

    • Size

      404KB

    • MD5

      f0f8b2044aedfe2be5ca3edcf7d1c05d

    • SHA1

      c0b72e6051824c07ee232e30cbb3aad78f05b91f

    • SHA256

      ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

    • SHA512

      d76b82f39fcc5a02673cb1bdcc2c7f24bbe056ee56900ca596d1c808593ed51ad09b787ab5897bdd3b0cfcf2ba3aa873dc4010737711f568571de6e8fcd27cad

    • SSDEEP

      3072:AASbgLok6IxenO3EfOT8ApeGMp2UYvTYiiVzfHxke7xrZGqATPZDzjr4DmxpmJlB:Adb6cO3EfOYApkKbY7Vzy2rqKSPAQB8l

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks