General

  • Target

    d48409b5c1d1148007127992d77a59486b8d85a29e7a1193b1382642d191de0a

  • Size

    2.3MB

  • Sample

    241229-e5hmcsspdq

  • MD5

    63503dad1500bc1408fa8bf9ee9a416b

  • SHA1

    0476e1d84e232e113ab4cebf3a6015fd1025e70d

  • SHA256

    d48409b5c1d1148007127992d77a59486b8d85a29e7a1193b1382642d191de0a

  • SHA512

    14d443081c5792902abf7a6d62b02964032a9437038abaec78fdfe575cc4d9ef50747fd0f1647bf3925123a0e8d42b949cfe85ca0408f733a9d645c5d50482a9

  • SSDEEP

    49152:EqvsA7BLQ1LNbZRzmAPLbM3mv1+nOOFB1Av:sACxbZNmAPLb+mv1+nOOF7Av

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      d48409b5c1d1148007127992d77a59486b8d85a29e7a1193b1382642d191de0a

    • Size

      2.3MB

    • MD5

      63503dad1500bc1408fa8bf9ee9a416b

    • SHA1

      0476e1d84e232e113ab4cebf3a6015fd1025e70d

    • SHA256

      d48409b5c1d1148007127992d77a59486b8d85a29e7a1193b1382642d191de0a

    • SHA512

      14d443081c5792902abf7a6d62b02964032a9437038abaec78fdfe575cc4d9ef50747fd0f1647bf3925123a0e8d42b949cfe85ca0408f733a9d645c5d50482a9

    • SSDEEP

      49152:EqvsA7BLQ1LNbZRzmAPLbM3mv1+nOOFB1Av:sACxbZNmAPLb+mv1+nOOF7Av

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks