General

  • Target

    907bf8e27fe48bc32475c15c1c05e2d8_JaffaCakes118

  • Size

    340KB

  • Sample

    241123-y9b5xs1ncq

  • MD5

    907bf8e27fe48bc32475c15c1c05e2d8

  • SHA1

    2d52508e2e1e88599ee159f84123f2b074c07d40

  • SHA256

    ba0dfc13415d5d2bdd5d2e13b38f512e2e10f788e8c978006b123252b2adba37

  • SHA512

    55a2a68237b85d3b0d27f47d608aee74ad474f52ea110165d1d57e84d0439f7144c54e17f99d43bc70b9e1f9310c03f49914522123572f3933ac5b3665ffe47d

  • SSDEEP

    6144:0gu1ICZ5nAON12aolxWQr3oz4NQHnpaZDZVu4SaRXlI/aYBWhnLe8ytKYn8j9Bbz:0gTCnnJ2tWUo0qHnpaZDZVu4SaRXlI/4

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      907bf8e27fe48bc32475c15c1c05e2d8_JaffaCakes118

    • Size

      340KB

    • MD5

      907bf8e27fe48bc32475c15c1c05e2d8

    • SHA1

      2d52508e2e1e88599ee159f84123f2b074c07d40

    • SHA256

      ba0dfc13415d5d2bdd5d2e13b38f512e2e10f788e8c978006b123252b2adba37

    • SHA512

      55a2a68237b85d3b0d27f47d608aee74ad474f52ea110165d1d57e84d0439f7144c54e17f99d43bc70b9e1f9310c03f49914522123572f3933ac5b3665ffe47d

    • SSDEEP

      6144:0gu1ICZ5nAON12aolxWQr3oz4NQHnpaZDZVu4SaRXlI/aYBWhnLe8ytKYn8j9Bbz:0gTCnnJ2tWUo0qHnpaZDZVu4SaRXlI/4

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks