pikabot | b26eea12f0335364ffc49ecd7b04865d451f4f227724458ce1412cfd841350ee | Triage

Sharing

General

Target

document_03.26.js
Size

31KB
Sample

240329-t59heace7z
MD5

e9c73ed6c39e2ef61523b30276577627
SHA1

f35c4cc45bfc6c9e0572a6a66237059e025b01d4
SHA256

b26eea12f0335364ffc49ecd7b04865d451f4f227724458ce1412cfd841350ee
SHA512

e4d6fae624e925476e0426d4e22f726cdfe675dc3414123ddbf061b34cf07558ec77fea4e91537f790e7e5fcc0bd78686a9344773fb9a006bcee423b37476d7a
SSDEEP

768:EDUXzs48+bNw749cw19CTW3YUwPyTUPu6a/n5/:EDcIcq7cZ9+AYFyTv6a/5/

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

158.220.95.214

172.232.208.90

194.233.91.144

158.220.95.215

84.247.157.112

Targets

- Target
  
  document_03.26.js
- Size
  
  31KB
- MD5
  
  e9c73ed6c39e2ef61523b30276577627
- SHA1
  
  f35c4cc45bfc6c9e0572a6a66237059e025b01d4
- SHA256
  
  b26eea12f0335364ffc49ecd7b04865d451f4f227724458ce1412cfd841350ee
- SHA512
  
  e4d6fae624e925476e0426d4e22f726cdfe675dc3414123ddbf061b34cf07558ec77fea4e91537f790e7e5fcc0bd78686a9344773fb9a006bcee423b37476d7a
- SSDEEP
  
  768:EDUXzs48+bNw749cw19CTW3YUwPyTUPu6a/n5/:EDcIcq7cZ9+AYFyTv6a/5/
Score

10^/10

pikabot botnet
- PikaBot
  PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
  botnet pikabot
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

behavioral3