General

  • Target

    3.exe

  • Size

    576KB

  • Sample

    250217-dt4j1syjds

  • MD5

    b320d4ccf59f49eefc5dd366b1c72de4

  • SHA1

    4e6c1ee56e824f200317b9ad791b0f0f6d596933

  • SHA256

    a455386e579b37b01b121424d4f0356e20a83a0e4a889f3fb7766a85fd36f908

  • SHA512

    45e0feee89a8d8c93704109f91dd0bbafb7ee7e9f12ea643484e47fc137f115b23163cf31fb2f14e101fbcb3d5d4323ca484a561eafa818c99bc59f8fa302eda

  • SSDEEP

    12288:AIbTE1rkt826L4xd1EiEt6empQ+uK+bn3RyFTesiXSkb/aZC:AI818EiYTmp0nQaZXZbSs

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      3.exe

    • Size

      576KB

    • MD5

      b320d4ccf59f49eefc5dd366b1c72de4

    • SHA1

      4e6c1ee56e824f200317b9ad791b0f0f6d596933

    • SHA256

      a455386e579b37b01b121424d4f0356e20a83a0e4a889f3fb7766a85fd36f908

    • SHA512

      45e0feee89a8d8c93704109f91dd0bbafb7ee7e9f12ea643484e47fc137f115b23163cf31fb2f14e101fbcb3d5d4323ca484a561eafa818c99bc59f8fa302eda

    • SSDEEP

      12288:AIbTE1rkt826L4xd1EiEt6empQ+uK+bn3RyFTesiXSkb/aZC:AI818EiYTmp0nQaZXZbSs

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Downloads MZ/PE file

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks