pikabot | 782cf0032bb2cfc90b406d3134e2332a6344ec36879d0131616c0d746bf171ce | Triage

Sharing

General

Target

3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.zip
Size

622KB
Sample

240402-lym2tsdh47
MD5

dab66fd39f62e5d16c3adba5d9e17386
SHA1

43b9f69cbb11d0cc79f4928e08216f438dfa4277
SHA256

782cf0032bb2cfc90b406d3134e2332a6344ec36879d0131616c0d746bf171ce
SHA512

e055a5be2dee5b71cb8b8c2e1191de2c8c15fd08b9c48201e639748b9438ade341d7f70c71ecf47cf1164edffb7f556dec67e38a4cdc9923f2bed4518d789baa
SSDEEP

12288:AusRbR9Ji1RUNtyUTf4vG9R25JhHdaBP/mNXW5uw7K9U2i3ERSjYn:AusFRkRUv1pye/uguYDSRA8

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Targets

- Target
  
  3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.exe
- Size
  
  1.4MB
- MD5
  
  cf435e0b10436bc7b504d6d4689e626c
- SHA1
  
  9da40327c2638b56e79e21bdb3871e4fb2fa669d
- SHA256
  
  3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa
- SHA512
  
  02e12e4a129b418aa95db9c33f39d6600b4ec2a7ca687fffabbc33b4c51b5103e85ff16ad0e90690112a4f6e7d4a226c1d385ac2e603e18b0c3341d53674970a
- SSDEEP
  
  24576:A3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6S:TmYqHU7pHYY00VcCDdowG3tMa6S
Score

10^/10

pikabot botnet
- PikaBot
  PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
  botnet pikabot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2