General

  • Target

    ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

  • Size

    404KB

  • Sample

    241112-hrvasaxekb

  • MD5

    f0f8b2044aedfe2be5ca3edcf7d1c05d

  • SHA1

    c0b72e6051824c07ee232e30cbb3aad78f05b91f

  • SHA256

    ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

  • SHA512

    d76b82f39fcc5a02673cb1bdcc2c7f24bbe056ee56900ca596d1c808593ed51ad09b787ab5897bdd3b0cfcf2ba3aa873dc4010737711f568571de6e8fcd27cad

  • SSDEEP

    3072:AASbgLok6IxenO3EfOT8ApeGMp2UYvTYiiVzfHxke7xrZGqATPZDzjr4DmxpmJlB:Adb6cO3EfOYApkKbY7Vzy2rqKSPAQB8l

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

    • Size

      404KB

    • MD5

      f0f8b2044aedfe2be5ca3edcf7d1c05d

    • SHA1

      c0b72e6051824c07ee232e30cbb3aad78f05b91f

    • SHA256

      ba0c555593b1e7effee005be863755ddbe1d68112ab97634483c1a86b56fa0ef

    • SHA512

      d76b82f39fcc5a02673cb1bdcc2c7f24bbe056ee56900ca596d1c808593ed51ad09b787ab5897bdd3b0cfcf2ba3aa873dc4010737711f568571de6e8fcd27cad

    • SSDEEP

      3072:AASbgLok6IxenO3EfOT8ApeGMp2UYvTYiiVzfHxke7xrZGqATPZDzjr4DmxpmJlB:Adb6cO3EfOYApkKbY7Vzy2rqKSPAQB8l

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.