pikabot | 899859d4540ee804d1545c1a45310b8031a8afaf18e1413f8dbaef09a5d87309 | Triage

Sharing

General

Target

ce79c488866ea23c1ca3d57e197cd5a90b7a9cbfd23387f1aa7beacf7641a3ac.zip
Size

622KB
Sample

240402-lywnzadh78
MD5

9a73b705625af679e2ea1d581e703d99
SHA1

703eaab4f6a5c3fc69ee6acc0e03572b1590be0b
SHA256

899859d4540ee804d1545c1a45310b8031a8afaf18e1413f8dbaef09a5d87309
SHA512

a5d8697a1b567dd25e695776078813358dc310682fa866aa332f901b82c5c28d6bf5ec1ea00535781ca560462b466777dbda01e52735797fe85feedbd2655fbf
SSDEEP

12288:P/rk4cuKsIN5s3DB37kfWuiDrgvIoN8kfSWNWnG29JHuVu:PTku7DXgvI+zqWNWnrmu

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Targets

- Target
  
  ce79c488866ea23c1ca3d57e197cd5a90b7a9cbfd23387f1aa7beacf7641a3ac.exe
- Size
  
  1.4MB
- MD5
  
  4d6bc5103eae5b88d312264ba8360da0
- SHA1
  
  adf6a77f2a83431c403e91177a61312b973051ba
- SHA256
  
  ce79c488866ea23c1ca3d57e197cd5a90b7a9cbfd23387f1aa7beacf7641a3ac
- SHA512
  
  89a232ba60e13b37286a00d1e8bb42e1338eb1f8b87ee866b95db51501dfc9230111d45bb5958b9feb150043cbc4e3e4862f05786e25eac4bd5a5de4555552d9
- SSDEEP
  
  24576:X3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:amYqHU7pHYY00VcCDdowG3tMa6
Score

10^/10

pikabot botnet
- PikaBot
  PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
  botnet pikabot
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2