General

  • Target

    c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec

  • Size

    374KB

  • Sample

    241211-pbnxdswnep

  • MD5

    9a5bb0cad32df50f58c266de40bae036

  • SHA1

    62c232cacde2b5d86a5032cd1a2379eedf889a7e

  • SHA256

    c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec

  • SHA512

    93903abce64c9ee5674fcb9bd4d2a439c2117cc21f087bd2c3cd913830d157434518fbf10c067774186a6610d706ad1cad28231b6af8e2a7d59a4d5fad000a64

  • SSDEEP

    6144:8LD5Gs375vaV1LEUR5gMv8c5WTMDjLhpuQxvG8u6PjBcHq8pXblFT0i8YlF:8LD5z9aPZ0dMfuQpLBc1TZF

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec

    • Size

      374KB

    • MD5

      9a5bb0cad32df50f58c266de40bae036

    • SHA1

      62c232cacde2b5d86a5032cd1a2379eedf889a7e

    • SHA256

      c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec

    • SHA512

      93903abce64c9ee5674fcb9bd4d2a439c2117cc21f087bd2c3cd913830d157434518fbf10c067774186a6610d706ad1cad28231b6af8e2a7d59a4d5fad000a64

    • SSDEEP

      6144:8LD5Gs375vaV1LEUR5gMv8c5WTMDjLhpuQxvG8u6PjBcHq8pXblFT0i8YlF:8LD5z9aPZ0dMfuQpLBc1TZF

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Ramnit family

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks