Overview

overview

10

Static

static

8

89dc500248...a9.exe

windows7-x64

1

89dc500248...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.zip

  • Size

    1.2MB

  • Sample

    240402-lyp67add8s

  • MD5

    16274f8fffd4e953f46c3ffc13fb7045

  • SHA1

    5257883f429eaa1fc2fb25070837991930cdfc36

  • SHA256

    f635f614efe260dae8f643cf75b52e3061779c47fd049775bfe50817226bbdc0

  • SHA512

    dd2c16f71d36dcb8ff322834e7e5766170119a8c2c6673050b9285c7aab034d77ac3a6f72fdd45634e97083a21a288cc98f88dd0d8e030e88dee7b439b0d6de2

  • SSDEEP

    24576:21puk+Inpd5Vq3289VVd31MxN1QjmBGFO1qDCGlmJDi0Gpxs1QJw:i7d50328zV5+1OcwOEDCGYQhpOH

Score
10/10
pikabotbotnetdave

Malware Config

Extracted

Family

pikabot

C2

141.95.106.106

104.129.55.106

104.129.55.105

23.226.138.161

145.239.135.24

85.239.243.155

23.226.138.143

57.128.165.176

178.18.246.136

Targets

    • Target

      89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

    • Size

      3.3MB

    • MD5

      f316f291a2998d6bbce2674c8aa3f349

    • SHA1

      bbe00380a62900c286d8506a040d99718dfd8932

    • SHA256

      89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9

    • SHA512

      84770262959e3b1470b324775e5d06665008b09f0f5de33eef02efab77a8a560b44d3a59668ab91294c79cf58ef026aa2ff5bd9b6199e6a0d5b295ff209ffe6b

    • SSDEEP

      49152:DCXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4a:DCxRXOhEc2MgJHTp+isLf

    Score
    10/10
    pikabotbotnet

    • PikaBot

      PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

      botnetpikabot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks