General

  • Target

    24c1453292a5e4810effb5c08819ca4b6b29f64d55b5f4df60fc77b5ab9d2e27

  • Size

    576KB

  • Sample

    250302-zrskmavtfz

  • MD5

    7ed6095182fcb21896bd4a3a0a48c10e

  • SHA1

    329fe9482c86e02c59c43c5fa7b9dfcbd098fac0

  • SHA256

    24c1453292a5e4810effb5c08819ca4b6b29f64d55b5f4df60fc77b5ab9d2e27

  • SHA512

    e24d89db072f6243e221a4748f1afb32b8140238ab87ddbb3ecef204a0a9ed7b2003e7ec888ca64640388fda0dd706eac75e88d3aa8258ff3b65c4b2542b7923

  • SSDEEP

    12288:3obTE1rkt826L4xd1EiEt6empQ+uK++YJTYbRda/nq+MwsmdYp7:3o818EiYTmpNYGc/namdYd

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      24c1453292a5e4810effb5c08819ca4b6b29f64d55b5f4df60fc77b5ab9d2e27

    • Size

      576KB

    • MD5

      7ed6095182fcb21896bd4a3a0a48c10e

    • SHA1

      329fe9482c86e02c59c43c5fa7b9dfcbd098fac0

    • SHA256

      24c1453292a5e4810effb5c08819ca4b6b29f64d55b5f4df60fc77b5ab9d2e27

    • SHA512

      e24d89db072f6243e221a4748f1afb32b8140238ab87ddbb3ecef204a0a9ed7b2003e7ec888ca64640388fda0dd706eac75e88d3aa8258ff3b65c4b2542b7923

    • SSDEEP

      12288:3obTE1rkt826L4xd1EiEt6empQ+uK++YJTYbRda/nq+MwsmdYp7:3o818EiYTmpNYGc/namdYd

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks