General

  • Target

    82402dd3ac817c5b2177cbcccab296d1593831e80728de125598f9b1aae449ed

  • Size

    576KB

  • Sample

    250218-bads5svngv

  • MD5

    d00631cd6c19276304dcd1e6c725b550

  • SHA1

    163eb33583ede3399138373446d9168c322a5c57

  • SHA256

    82402dd3ac817c5b2177cbcccab296d1593831e80728de125598f9b1aae449ed

  • SHA512

    a101a0905ee31e4deacd4fea0d194d5be50e7e07508f822a04752deba2ecb9353c68254c7f28721ecdc5510576005ad26c4993fb2190222d148aa6cd89de4548

  • SSDEEP

    12288:jzbTE1rkt826L4xd1EiEt6empQ+uK+A5crs4uN5JKXIBoKOJFTyoswPg51qkiNj:jz818EiYTmpX2rs4ubJDBhQTyoswPg5c

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      82402dd3ac817c5b2177cbcccab296d1593831e80728de125598f9b1aae449ed

    • Size

      576KB

    • MD5

      d00631cd6c19276304dcd1e6c725b550

    • SHA1

      163eb33583ede3399138373446d9168c322a5c57

    • SHA256

      82402dd3ac817c5b2177cbcccab296d1593831e80728de125598f9b1aae449ed

    • SHA512

      a101a0905ee31e4deacd4fea0d194d5be50e7e07508f822a04752deba2ecb9353c68254c7f28721ecdc5510576005ad26c4993fb2190222d148aa6cd89de4548

    • SSDEEP

      12288:jzbTE1rkt826L4xd1EiEt6empQ+uK+A5crs4uN5JKXIBoKOJFTyoswPg51qkiNj:jz818EiYTmpX2rs4ubJDBhQTyoswPg5c

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks