Overview

overview

10

Static

static

3

Y98.dlld.dll

windows10-2004-x64

10

Resubmissions

31-10-2023 03:33

231031-d4h13agd3w 10

27-10-2023 11:41

231027-ntewrsff73 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Y98.dlld.dll

  • Size

    3.8MB

  • Sample

    231031-d4h13agd3w

  • MD5

    51967a61a0b543123e281a654aec3879

  • SHA1

    d1c306c401976b57c41c2a6ae205fdad114a30bc

  • SHA256

    fe3221dba8fc8959279f6cc2aa4b8ad695f69176f81094a4562ac271d4810f31

  • SHA512

    1a2d65a29953c657de03041946e3b7302928fa2ef361593c68eddc7e0fdc966fa563200e0c615d06b60caa2912b131136d76ddabbc10fe785a9499829c40eaad

  • SSDEEP

    98304:ROpUerIHzl1QEfGMFWF9A2t0PQ3PrcS/5n44:Rve0fQEfrjPa/44

Score
10/10
pikabotbotnetcore

Malware Config

Targets

    • Target

      Y98.dlld.dll

    • Size

      3.8MB

    • MD5

      51967a61a0b543123e281a654aec3879

    • SHA1

      d1c306c401976b57c41c2a6ae205fdad114a30bc

    • SHA256

      fe3221dba8fc8959279f6cc2aa4b8ad695f69176f81094a4562ac271d4810f31

    • SHA512

      1a2d65a29953c657de03041946e3b7302928fa2ef361593c68eddc7e0fdc966fa563200e0c615d06b60caa2912b131136d76ddabbc10fe785a9499829c40eaad

    • SSDEEP

      98304:ROpUerIHzl1QEfGMFWF9A2t0PQ3PrcS/5n44:Rve0fQEfrjPa/44

    Score
    10/10
    pikabotbotnetcore

    • PikaBot

      PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

      botnetpikabot

    • pikabot_core

      Detects pikabot core payload

      core

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks