General

  • Target

    JaffaCakes118_67b5d9bd34094f26511db8750dc72db8

  • Size

    293KB

  • Sample

    250107-rlsdnsvkat

  • MD5

    67b5d9bd34094f26511db8750dc72db8

  • SHA1

    d7dfc3fdf897b3e2b3bbcc8ff99435b0be638f0a

  • SHA256

    a608addb9459e8279ea7bbec334f61ba87cbe8bb2ccb7011408f851349258827

  • SHA512

    408b6aa737283ae623a6562cf7600c8dfa381094e886197359beadac1da6a28db7756d0a978ec8a0acb0aae454439c256457d7540a930726a597738b59d398ab

  • SSDEEP

    3072:9RJBHSrjk0yAwLHA05llHI1jdp1ZOQAMIZtyoBZbfCZ3UXxBxaBjpeFnyTShYh/z:LLuegnIZtxBk2XNahpeFnkwYRMHJE

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      JaffaCakes118_67b5d9bd34094f26511db8750dc72db8

    • Size

      293KB

    • MD5

      67b5d9bd34094f26511db8750dc72db8

    • SHA1

      d7dfc3fdf897b3e2b3bbcc8ff99435b0be638f0a

    • SHA256

      a608addb9459e8279ea7bbec334f61ba87cbe8bb2ccb7011408f851349258827

    • SHA512

      408b6aa737283ae623a6562cf7600c8dfa381094e886197359beadac1da6a28db7756d0a978ec8a0acb0aae454439c256457d7540a930726a597738b59d398ab

    • SSDEEP

      3072:9RJBHSrjk0yAwLHA05llHI1jdp1ZOQAMIZtyoBZbfCZ3UXxBxaBjpeFnyTShYh/z:LLuegnIZtxBk2XNahpeFnkwYRMHJE

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks