Overview

overview

10

Static

static

3

dd2b6e3aa7...df.dll

windows7-x64

3

dd2b6e3aa7...df.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    dd2b6e3aa75de8460730862f2dc739537734a7dfc9e673b6a23ee58430348ddf.zip
  • Size 452KB
  • Sample240402-qtk4wsbe4z
  • SHA256 6246f43bd1a5ef67db2a2170cf12bef8bfbbcc58f3f9a9072832d3ac20729a42
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
pikabotbotnetdiscovery

Malware Config

Extracted

Family

  • pikabot

C2

  • https://154.53.55.165:13719

  • https://158.247.240.58:5688

  • https://70.34.223.164:5000

  • https://70.34.199.64:9785

  • https://45.77.63.237:5687

  • https://198.38.94.213:2224

  • https://94.72.104.80:5000

  • https://84.46.240.42:2083

  • https://154.12.236.248:13722

  • https://94.72.104.77:13724

  • https://209.126.86.48:1194

Targets

    • Target
      dd2b6e3aa75de8460730862f2dc739537734a7dfc9e673b6a23ee58430348ddf.dll
    • Size 840KB
    • SHA256 dd2b6e3aa75de8460730862f2dc739537734a7dfc9e673b6a23ee58430348ddf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypikabotbotnet

    • PikaBot

      PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

      botnetpikabot

    • Pikabot family

      pikabot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks