General

  • Target

    dba63f52491136cfecae3373b4b244fc0049f116a7f27bc2c9e7da39fa0c5c1c.exe

  • Size

    433KB

  • Sample

    250306-lc9cyavtgy

  • MD5

    da3f172a4088d16c071588f696723251

  • SHA1

    d3709b49bad46474bb59b4586d776f0a286ef82c

  • SHA256

    dba63f52491136cfecae3373b4b244fc0049f116a7f27bc2c9e7da39fa0c5c1c

  • SHA512

    a81714b5f58265502cd6a0923f0af91d9ac6d78e7bc46344ad9235530210ad33f99820d0749aa990073f7b0681d915a4b827d6260865a261b1c54c3b880ba523

  • SSDEEP

    6144:+pZCM0gQ/kT0Ah9WIIxp/sDcMT+00c/AaaIE:+3WgQsTzhnIMDcM30GAaw

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ashfkwu.ru:9821

yekfhsh.ru:7372

fasefja.ru:3410

hpifnad.ru:3721

benkofx.ru:3333

fpzskbx.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      dba63f52491136cfecae3373b4b244fc0049f116a7f27bc2c9e7da39fa0c5c1c.exe

    • Size

      433KB

    • MD5

      da3f172a4088d16c071588f696723251

    • SHA1

      d3709b49bad46474bb59b4586d776f0a286ef82c

    • SHA256

      dba63f52491136cfecae3373b4b244fc0049f116a7f27bc2c9e7da39fa0c5c1c

    • SHA512

      a81714b5f58265502cd6a0923f0af91d9ac6d78e7bc46344ad9235530210ad33f99820d0749aa990073f7b0681d915a4b827d6260865a261b1c54c3b880ba523

    • SSDEEP

      6144:+pZCM0gQ/kT0Ah9WIIxp/sDcMT+00c/AaaIE:+3WgQsTzhnIMDcM30GAaw

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks