Overview

overview

10

Static

static

1

DISTINCTIOQ.jar

windows7-x64

7

DISTINCTIOQ.jar

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DISTINCTIOQ.jar
  • Size 337KB
  • Sample240423-ppf4psgc64
  • SHA256 267895bb452a1cc607155917f13672d66e394ec30e34f5689d427e6cd81ca15b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
pikabotbotnetdiscovery

Malware Config

Extracted

Family

  • pikabot

C2

  • https://45.76.251.190:5567

  • https://131.153.231.178:2221

  • https://95.179.135.3:2225

  • https://155.138.147.62:2223

  • https://86.38.225.109:13724

  • https://172.232.189.219:2224

  • https://198.44.187.12:2224

  • https://104.156.233.235:2226

  • https://103.82.243.5:13721

  • https://86.38.225.106:2221

  • https://45.32.248.100:2226

  • https://23.226.138.161:5242

  • https://37.60.242.85:9785

  • https://104.129.55.105:2223

  • https://45.32.21.184:5242

  • https://178.18.246.136:2078

  • https://108.61.78.17:13719

  • https://86.38.225.105:13721

  • https://172.232.189.10:1194

  • https://172.232.162.97:13719

Targets

    • Target
      DISTINCTIOQ.jar
    • Size 337KB
    • SHA256 267895bb452a1cc607155917f13672d66e394ec30e34f5689d427e6cd81ca15b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    pikabotbotnetdiscovery

    • PikaBot

      PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

      botnetpikabot

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks