General

  • Target

    ccc08fac567f3985004dde2bb45046b1b85097e4fdb44371e2d2dc29e5b338d5

  • Size

    156KB

  • Sample

    250326-rmbgjswya1

  • MD5

    ec923aaa332232b209f13c6cc7052652

  • SHA1

    6553b783543911fa8edbac5ba948199a6645bc4f

  • SHA256

    ccc08fac567f3985004dde2bb45046b1b85097e4fdb44371e2d2dc29e5b338d5

  • SHA512

    94be55d37423632578b1fc627661eacf1a4b6a8da0c2730b35921fcb798edfb38a02d88374786212798a7fe96b0f87e69a0605277d352ad246a18358f27ee144

  • SSDEEP

    3072:pvlDluUnj+inSoXPN8nWCPtzWfFeze52:pvlDluUnKWXVI9ta

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Targets

    • Target

      ccc08fac567f3985004dde2bb45046b1b85097e4fdb44371e2d2dc29e5b338d5

    • Size

      156KB

    • MD5

      ec923aaa332232b209f13c6cc7052652

    • SHA1

      6553b783543911fa8edbac5ba948199a6645bc4f

    • SHA256

      ccc08fac567f3985004dde2bb45046b1b85097e4fdb44371e2d2dc29e5b338d5

    • SHA512

      94be55d37423632578b1fc627661eacf1a4b6a8da0c2730b35921fcb798edfb38a02d88374786212798a7fe96b0f87e69a0605277d352ad246a18358f27ee144

    • SSDEEP

      3072:pvlDluUnj+inSoXPN8nWCPtzWfFeze52:pvlDluUnKWXVI9ta

    • Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Mylobot family

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks