General

  • Target

    53b21cdea112910771ad7f56ed59d2cd793df60fdc18192649159efc88868aec.exe

  • Size

    576KB

  • Sample

    250307-e1f8qstwhx

  • MD5

    3ce8c08985645fbacc3b7e197ebe0a4a

  • SHA1

    4e10c27c4f43db72320ec35e9a774270bdc6fe40

  • SHA256

    53b21cdea112910771ad7f56ed59d2cd793df60fdc18192649159efc88868aec

  • SHA512

    8bcc3ce63a1df20681b9d2d7d996c63f2ba2683d7d8d37eb3b52b37600379a76725540dccadbe6c81fcd101d4e54d4062c4e80da0d0987c55ef760f9dffc2ebd

  • SSDEEP

    12288:HPbTE1rkt826L4xd1EiEt6empQ+uK+1faH7nCYNFbdmmIO1ZUsCjW79u:HP818EiYTmpqCHNbvIODnCjW78

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Targets

    • Target

      53b21cdea112910771ad7f56ed59d2cd793df60fdc18192649159efc88868aec.exe

    • Size

      576KB

    • MD5

      3ce8c08985645fbacc3b7e197ebe0a4a

    • SHA1

      4e10c27c4f43db72320ec35e9a774270bdc6fe40

    • SHA256

      53b21cdea112910771ad7f56ed59d2cd793df60fdc18192649159efc88868aec

    • SHA512

      8bcc3ce63a1df20681b9d2d7d996c63f2ba2683d7d8d37eb3b52b37600379a76725540dccadbe6c81fcd101d4e54d4062c4e80da0d0987c55ef760f9dffc2ebd

    • SSDEEP

      12288:HPbTE1rkt826L4xd1EiEt6empQ+uK+1faH7nCYNFbdmmIO1ZUsCjW79u:HP818EiYTmpqCHNbvIODnCjW78

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks