General
-
Target
89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.zip
-
Size
1.2MB
-
Sample
240325-w5mdzsab5s
-
MD5
0063053ce6730c6ef6484b9afb2969a3
-
SHA1
e70e419d1d392dd2a08fe1c3976c86bec439623e
-
SHA256
3d8f91d7adecc379b5b7b73fd5703e0b9c98e77e2a1f651e24474eec3e7dced4
-
SHA512
b898b2bc15e5e57fad624f35a5cae4464ce3d1cde16723872479184a2ca104a37d5edf94f356e03e3dcf13b7351c26222db3c8bfb2f8581f8d2fddeafb34230a
-
SSDEEP
24576:yTMjbfcMOE6dTGrbtZVV1980PM4kotRJro45aG2fu7UnAEmABtfeXE7sKCvsqM4n:yTMfvjr19JPVkotRtofrfV1/WXE7sDlZ
Malware Config
Extracted
pikabot
https://141.95.106.106:2967
https://198.44.187.12:2224
https://104.129.55.106:13719
https://154.12.233.66:2224
https://104.129.55.105:2223
https://37.60.242.85:9785
https://23.226.138.161:5242
https://145.239.135.24:5243
https://86.38.225.105:13721
https://85.239.243.155:5000
https://89.117.23.186:5686
https://23.226.138.143:2083
https://103.82.243.5:13721
https://89.117.23.185:2221
https://86.38.225.106:2221
https://57.128.165.176:13721
https://178.18.246.136:2078
https://154.12.248.41:5000
Targets
-
-
Target
89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
-
Size
3.3MB
-
MD5
f316f291a2998d6bbce2674c8aa3f349
-
SHA1
bbe00380a62900c286d8506a040d99718dfd8932
-
SHA256
89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9
-
SHA512
84770262959e3b1470b324775e5d06665008b09f0f5de33eef02efab77a8a560b44d3a59668ab91294c79cf58ef026aa2ff5bd9b6199e6a0d5b295ff209ffe6b
-
SSDEEP
49152:DCXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4a:DCxRXOhEc2MgJHTp+isLf
Score10/10-
PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
-
Pikabot family
-
Suspicious use of SetThreadContext
-