Overview

overview

10

Static

static

10

260110-31c...ed.zip

windows10-2004-x64

1

260110-31c...ed.zip

windows11-21h2-x64

1

cone.exe.zip

windows10-2004-x64

1

cone.exe.zip

windows11-21h2-x64

1

2to1ep.exe

windows10-2004-x64

10

2to1ep.exe

windows11-21h2-x64

10

main.pyc

windows10-2004-x64

3

main.pyc

windows11-21h2-x64

3

4363463463...63.exe

windows10-2004-x64

10

4363463463...63.exe

windows11-21h2-x64

10

Synaptics.exe

windows10-2004-x64

Synaptics.exe

windows11-21h2-x64

10

TsarBomba.exe

windows10-2004-x64

10

TsarBomba.exe

windows11-21h2-x64

10

cobaltstri...de.exe

windows10-2004-x64

10

cobaltstri...de.exe

windows11-21h2-x64

10

ed01ebfbc9...aa.exe

windows10-2004-x64

10

ed01ebfbc9...aa.exe

windows11-21h2-x64

10

random.exe

windows10-2004-x64

10

random.exe

windows11-21h2-x64

10

Resubmissions

18/08/2026, 19:34

260818-x972xsygjb10

02/07/2026, 09:19

260702-labnwsfs6z

29/05/2026, 16:41

260529-t7a3mabx7l

26/05/2026, 03:15

260526-dr1qcadz4y

21/05/2026, 18:13

260521-wt38csgz7110

21/05/2026, 18:04

260521-wnpssagx3s10

21/05/2026, 17:59

260521-wkpzdady5j10

21/05/2026, 17:58

260521-wj9bmady2k

21/05/2026, 17:58

260521-wj5y7sgv4v

21/05/2026, 17:57

260521-wj2lsagv3z

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/02/2026, 09:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4363463463464363463463463.exe
  • Size 10KB
  • Sample260211-leyn8aes8e
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorbotnetdiscoverymylobotpersistencepyinstallerrat

Malware Config

Extracted

Family

  • mylobot

C2

  • pqrqtaz.ru:9879

  • pickcas.ru:6464

  • quwkbin.ru:3496

  • rkbupij.ru:6653

  • pcqmayq.ru:3629

  • mmuliwe.ru:3541

  • stoizji.ru:5189

  • sfdfrhh.ru:3511

  • ynciazz.ru:4127

  • mkglhnw.ru:1946

  • njeeili.ru:9987

  • dldzeoo.ru:7525

  • tkbiqjq.ru:5145

  • uenosbl.ru:2935

  • faayshc.ru:9865

  • nttfazc.ru:6761

  • nfwsyog.ru:7172

  • uyfusxm.ru:7372

  • hxkclwx.ru:1294

  • zgoysam.ru:2338

Signatures

  • Mylobot

    Botnet which first appeared in 2017 written in C++.

    botnetmylobot
  • Mylobot family
    mylobot
  • Downloads MZ/PE file 3 IoCs
  • Detects GoToResolve remote administration tool 1 IoCs

    GoToResolve is a remote administration tool that can be used as a backdoor

    backdoorrat
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 17 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 2 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3864
    • C:\Users\Admin\AppData\Local\Temp\Files\apps.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\apps.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2312
    • C:\Users\Admin\AppData\Local\Temp\Files\o.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Users\Admin\AppData\Local\Temp\Files\o.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:5084
    • C:\Users\Admin\AppData\Local\Temp\Files\ui.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Users\Admin\AppData\Local\Temp\Files\ui.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:880

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        apps.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\apps.exe
        • Size 23.4MB
        • SHA256 fb5c94c6c881b9c467c19233371d50403db03c2fce03b7d2ea33866ce99d2a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        o.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\o.exe
        • Size 107KB
        • SHA256 c9970ea5cbfb7712430399ef0484e3ac36b628c90f7ca270a3a2d4e9887f4fdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Files\ui.exe
        • Size 10.0MB
        • SHA256 752dd7563038241bd57990937e5e55d0b5e105b32964ba1b1952e5ec56ae0cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\VCRUNTIME140.dll
        • Size 88KB
        • SHA256 35afadbacc9a30341c1a5ee2117e69583e5044cea0bfab636dccbdcc281a8786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_bz2.pyd
        • Size 77KB
        • SHA256 4f9b79d8cff3a5db7e8df2e80b1251c20e4157770ea23016b4623dca723322ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_ctypes.pyd
        • Size 104KB
        • SHA256 73def59a8e7b956f51ab8d82815424786e8eef8e7f911d4612302f7d0eb8090d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_hashlib.pyd
        • Size 46KB
        • SHA256 9dcf1fe1af1b71270f9a4b8d06544f1f54df6f247cbeda305a903b2f6a8d75e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_lzma.pyd
        • Size 144KB
        • SHA256 594bbd9b409c6ea7974378a206b4249db2474af060c3df72a475ce866ad3510c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_queue.pyd
        • Size 26KB
        • SHA256 1f33fe39d67f20ac723bc282f78d3c3a6feaa3ef2a61cd8765777f3483decfb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_socket.pyd
        • Size 65KB
        • SHA256 887f6c73aee7ed3962394316ea77fb68231734cd2359fb3407ccf6659567aede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_ssl.pyd
        • Size 136KB
        • SHA256 f3eb2ea1cdf2e235b59eeaea4ef0aa030ccbd791f1f017790a4074b884bf8bb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_tkinter.pyd
        • Size 51KB
        • SHA256 5aa4d425384f4503dcfef835636ebfd9b144ab454f9e6d5e576f1da89ace41b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_uuid.pyd
        • Size 21KB
        • SHA256 616b3b2c7971d20421b0e5bc310595f75f4c4564e4cb75ca95a6e2d2b6b6ff15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\base_library.zip
        • Size 1.7MB
        • SHA256 7ecd1dfe0dcc82c2e595729cb238acb890326adc87136334ce9c21a5f0c847bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\libcrypto-1_1.dll
        • Size 2.2MB
        • SHA256 239d518dd67d8c2bbf6aeaded86ed464865e914db6bf3b115973d525ebd7d367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\libffi-8.dll
        • Size 32KB
        • SHA256 2ea8b56672fef068c06f5983a3f5d4ed85ebcede3bb5e7759d4acb48f830a365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\libssl-1_1.dll
        • Size 536KB
        • SHA256 52224881670ced6419a3e68731e5e3d0b1d224d5816619dccf6161f91ec78021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\python311.dll
        • Size 4.7MB
        • SHA256 4730f14f7db4f9fc657b23d050108bd54b3a721a0825190aa14f1a08c9028fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\select.pyd
        • Size 25KB
        • SHA256 3e42ef15194749477093ed32831fc11dcd053b99b048fd53354e620e726fa54d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl86t.dll
        • Size 1.4MB
        • SHA256 7ed409592314926d14c5d1663fce0701d1b0a2bc6d0360bfbe4014efd230f7df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msgcat-1.6.1.tm
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl8\8.5\msgcat-1.6.1.tm
        • Size 34KB
        • SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\auto.tcl
        • Size 21KB
        • SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\http1.0\pkgIndex.tcl
        • Size 746B
        • SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\init.tcl
        • Size 25KB
        • SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\opt0.4\pkgIndex.tcl
        • Size 620B
        • SHA256 6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        package.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\package.tcl
        • Size 23KB
        • SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\tclIndex
        • Size 5KB
        • SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tm.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl\tm.tcl
        • Size 11KB
        • SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk86t.dll
        • Size 1.2MB
        • SHA256 f37b85b38f04303a1394c95dd2e67f08efbde1bafd9bfc3b2403e171bf5f979b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        button.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\button.tcl
        • Size 21KB
        • SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        entry.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\entry.tcl
        • Size 17KB
        • SHA256 af1de90270693273b52fc735da6b5cd5ca794f5afd4cf03ffd95147161098048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icons.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\icons.tcl
        • Size 10KB
        • SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        listbox.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\listbox.tcl
        • Size 14KB
        • SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        menu.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\menu.tcl
        • Size 38KB
        • SHA256 d1283f67e435aab0bdbe9fdaa540a162043f8d652c02fe79f3843a451f123d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        panedwindow.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\panedwindow.tcl
        • Size 5KB
        • SHA256 aa4f87e41ac8297f51150f2a9f787607690d01793456b93f0939c54d394731f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\pkgIndex.tcl
        • Size 376B
        • SHA256 3f2539e85e2a9017913e61fe2600b499315e1a6f249a4ff90e0b530a1eeb8898
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        scale.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\scale.tcl
        • Size 7KB
        • SHA256 0da2dc955ffd71062a21c3b747d9d59d66a5b09a907b9ed220be1b2342205a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scrlbar.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\scrlbar.tcl
        • Size 12KB
        • SHA256 eec90404f702d3cfbfaec0f13bf5ed1ebeb736bee12d7e69770181a25401c61f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spinbox.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\spinbox.tcl
        • Size 16KB
        • SHA256 2ff791a44406dc8339c7da6116e6ec92289bee5fc1367d378f48094f4abea277
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        text.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\text.tcl
        • Size 34KB
        • SHA256 4a42ad370e0cd93d4133b49788c0b0e1c7cd78383e88bacb51cb751e8bfda15e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk\tk.tcl
        • Size 23KB
        • SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/880-1065-0x0000000003BD0000-0x0000000003C8F000-memory.dmp
        Download

        memory/3864-0-0x0000000000E60000-0x0000000000E68000-memory.dmp
        Download

        memory/3864-1080-0x00000000056D0000-0x000000000595B000-memory.dmp
        Download

        memory/3864-1073-0x00000000056D0000-0x000000000595B000-memory.dmp
        Download

        memory/3864-1061-0x00000000056D0000-0x000000000595B000-memory.dmp
        Download

        memory/3864-1-0x0000000005A50000-0x0000000005AEC000-memory.dmp
        Download

        memory/3864-45-0x0000000007070000-0x0000000007071000-memory.dmp
        Download

        memory/3864-2-0x0000000005C40000-0x0000000005C50000-memory.dmp
        Download

        memory/3864-3-0x00000000056D0000-0x000000000595B000-memory.dmp
        Download

        memory/3864-4-0x0000000005C40000-0x0000000005C50000-memory.dmp
        Download

        memory/3864-10-0x00000000056D0000-0x000000000595B000-memory.dmp
        Download

        memory/4924-37-0x0000000000730000-0x0000000000734000-memory.dmp
        Download

        memory/4924-32-0x0000000000730000-0x0000000000734000-memory.dmp
        Download

        memory/4952-38-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/4952-48-0x0000000002BC0000-0x0000000002CAA000-memory.dmp
        Download

        memory/4952-49-0x0000000002CB0000-0x0000000002CC8000-memory.dmp
        Download

        memory/4952-47-0x0000000002730000-0x0000000002749000-memory.dmp
        Download

        memory/4952-39-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/4952-36-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/4952-50-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/4952-34-0x0000000000400000-0x0000000000436000-memory.dmp
        Download

        memory/5084-46-0x0000000001220000-0x0000000001256000-memory.dmp
        Download

        memory/5084-41-0x0000000001220000-0x0000000001256000-memory.dmp
        Download

        memory/5084-44-0x0000000001220000-0x0000000001256000-memory.dmp
        Download

        memory/5084-1063-0x0000000003E40000-0x0000000003F2A000-memory.dmp
        Download

        memory/5084-1064-0x0000000003F30000-0x0000000003F48000-memory.dmp
        Download

        memory/5084-1062-0x0000000003460000-0x0000000003479000-memory.dmp
        Download

        memory/5084-43-0x0000000001220000-0x0000000001256000-memory.dmp
        Download

        memory/5084-42-0x0000000001220000-0x0000000001256000-memory.dmp
        Download

        memory/5084-40-0x0000000001220000-0x0000000001256000-memory.dmp
        Download