pikabot | a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b | Triage

Sharing

General

Target

a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b
Size

455KB
Sample

231005-ea1vfsge5v
MD5

87dc797b60c660967550e977c456bbbb
SHA1

958cb16f78f766ad9dc248a2651cf7fce324bc54
SHA256

a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b
SHA512

728eb8588ae47e268cc23b3adcc047e043acd0ce5b1d04854a1cc058b43f3bb816c6453cebf22a6f5482fcd6d0cd02972b803a23fe9046ccf8f644c3a57977ca
SSDEEP

6144:zfDT6Bf++wbTPg37B+fEktaw9p/TEkMxp+aiCrIB28UJ1F5FRpS0X:Ha5sTPgrB+fl/TEkMqaHrIByJ13pR

Score

10^/10

pikabot botnet persistence

Malware Config

Targets

- Target
  
  a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b
- Size
  
  455KB
- MD5
  
  87dc797b60c660967550e977c456bbbb
- SHA1
  
  958cb16f78f766ad9dc248a2651cf7fce324bc54
- SHA256
  
  a7122f6a2953f7c5960747cc165308fc3a33a7cb5e6b0093cff2855db2ecce7b
- SHA512
  
  728eb8588ae47e268cc23b3adcc047e043acd0ce5b1d04854a1cc058b43f3bb816c6453cebf22a6f5482fcd6d0cd02972b803a23fe9046ccf8f644c3a57977ca
- SSDEEP
  
  6144:zfDT6Bf++wbTPg37B+fEktaw9p/TEkMxp+aiCrIB28UJ1F5FRpS0X:Ha5sTPgrB+fl/TEkMqaHrIByJ13pR
Score

10^/10

pikabot botnet persistence
- Detects PikaBot botnet
- PikaBot
  PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
  botnet pikabot
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

pikabotbotnetpersistence