pikabot | ff214b88e423a5be59e89962f8a61e9565e72bbf4dee9bdc9cf6d25fda1526fc | Triage

Sharing

General

Target

b26eea12f0335364ffc49ecd7b04865d451f4f227724458ce1412cfd841350ee.zip
Size

3KB
Sample

240327-l7szfahh42
MD5

f2fc922b96af4b5061c042655ef1616e
SHA1

cc8b6577717d697411e7cece2f3c3230e5cfb11a
SHA256

ff214b88e423a5be59e89962f8a61e9565e72bbf4dee9bdc9cf6d25fda1526fc
SHA512

4059fd7116ec423aa53fd220c5ab3d9e21b8516cb6f4b017dbec519a856133c098baa7f746ae1113cbe25e993f066feb79ffb74aa1c84bcfa4444cca9e23164d

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

158.220.95.214

172.232.208.90

194.233.91.144

158.220.95.215

84.247.157.112

Targets

- Target
  
  b26eea12f0335364ffc49ecd7b04865d451f4f227724458ce1412cfd841350ee.js
- Size
  
  31KB
- MD5
  
  e9c73ed6c39e2ef61523b30276577627
- SHA1
  
  f35c4cc45bfc6c9e0572a6a66237059e025b01d4
- SHA256
  
  b26eea12f0335364ffc49ecd7b04865d451f4f227724458ce1412cfd841350ee
- SHA512
  
  e4d6fae624e925476e0426d4e22f726cdfe675dc3414123ddbf061b34cf07558ec77fea4e91537f790e7e5fcc0bd78686a9344773fb9a006bcee423b37476d7a
- SSDEEP
  
  768:EDUXzs48+bNw749cw19CTW3YUwPyTUPu6a/n5/:EDcIcq7cZ9+AYFyTv6a/5/
Score

10^/10

pikabot botnet
- PikaBot
  PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
  botnet pikabot
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2