General

  • Target
    541b6fee0d3a29a5e837e1b3d0376b3d06d3dd368ee7b820075ab1246622b2be.exe
  • Size 320KB
  • Sample260512-f7f2zsbs8m
  • SHA256 541b6fee0d3a29a5e837e1b3d0376b3d06d3dd368ee7b820075ab1246622b2be
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • mylobot

C2
  • pqrqtaz.ru:9879

  • pickcas.ru:6464

  • quwkbin.ru:3496

  • rkbupij.ru:6653

  • pcqmayq.ru:3629

  • mmuliwe.ru:3541

  • stoizji.ru:5189

  • sfdfrhh.ru:3511

  • ynciazz.ru:4127

  • mkglhnw.ru:1946

  • njeeili.ru:9987

  • dldzeoo.ru:7525

  • tkbiqjq.ru:5145

  • uenosbl.ru:2935

  • faayshc.ru:9865

  • nttfazc.ru:6761

  • nfwsyog.ru:7172

  • uyfusxm.ru:7372

  • hxkclwx.ru:1294

  • zgoysam.ru:2338

Targets

    • Target
      541b6fee0d3a29a5e837e1b3d0376b3d06d3dd368ee7b820075ab1246622b2be.exe
    • Size 320KB
    • SHA256 541b6fee0d3a29a5e837e1b3d0376b3d06d3dd368ee7b820075ab1246622b2be
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks