Overview

overview

10

Static

static

3

a7122f6a29...7b.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b

  • Size

    455KB

  • Sample

    231005-ea1vfsge5v

  • MD5

    87dc797b60c660967550e977c456bbbb

  • SHA1

    958cb16f78f766ad9dc248a2651cf7fce324bc54

  • SHA256

    a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b

  • SHA512

    728eb8588ae47e268cc23b3adcc047e043acd0ce5b1d04854a1cc058b43f3bb816c6453cebf22a6f5482fcd6d0cd02972b803a23fe9046ccf8f644c3a57977ca

  • SSDEEP

    6144:zfDT6Bf++wbTPg37B+fEktaw9p/TEkMxp+aiCrIB28UJ1F5FRpS0X:Ha5sTPgrB+fl/TEkMqaHrIByJ13pR

Score
10/10
pikabotbotnetpersistence

Malware Config

Targets

    • Target

      a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b

    • Size

      455KB

    • MD5

      87dc797b60c660967550e977c456bbbb

    • SHA1

      958cb16f78f766ad9dc248a2651cf7fce324bc54

    • SHA256

      a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b

    • SHA512

      728eb8588ae47e268cc23b3adcc047e043acd0ce5b1d04854a1cc058b43f3bb816c6453cebf22a6f5482fcd6d0cd02972b803a23fe9046ccf8f644c3a57977ca

    • SSDEEP

      6144:zfDT6Bf++wbTPg37B+fEktaw9p/TEkMxp+aiCrIB28UJ1F5FRpS0X:Ha5sTPgrB+fl/TEkMqaHrIByJ13pR

    Score
    10/10
    pikabotbotnetpersistence

    • Detects PikaBot botnet

    • PikaBot

      PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

      botnetpikabot

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks