Overview

overview

10

Static

static

1

Lisect_AVT...02.exe

windows7-x64

3

Lisect_AVT...02.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Lisect_AVT_24003_G1B_102.exe

  • Size

    1.4MB

  • Sample

    240725-cqrwdawald

  • MD5

    942a88cb77eae630a1b630fb72895c21

  • SHA1

    b3aeba413fa2caa928f5e02d97f316dc424574e2

  • SHA256

    baee4a674b04576f9c58c7fdb3ebb71620d33a6fb8ab2ef539880384350e6c16

  • SHA512

    fbd5758eb630afd22365c762dc1d7b7710d9f0b0ecf54f0e8b6207b2242dead0d18cb34040dd1244212b0ea424565bf8c7ccc50e1c60e84a613c7b2f74bdc38c

  • SSDEEP

    24576:13dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:AmYqHU7pHYY00VcCDdowG3tMa6

Score
10/10
pikabotbotnetdiscovery

Malware Config

Extracted

Family

pikabot

C2

https://109.199.99.131:13721

https://154.38.175.241:13721

https://148.113.141.220:2224

https://23.226.138.143:2083

https://89.117.23.186:5686

https://23.226.138.161:5242

https://103.82.243.5:13721

https://145.239.135.24:5243

https://185.179.217.216:9785

https://154.12.248.41:5000

https://178.18.246.136:2078

https://141.95.106.106:2967

https://104.129.55.105:2223

https://57.128.165.176:13721

https://89.117.23.185:2221

https://86.38.225.106:2221

https://37.60.242.86:2967

https://37.60.242.85:9785

https://89.117.23.34:5938

https://154.12.233.66:2224

Targets

    • Target

      Lisect_AVT_24003_G1B_102.exe

    • Size

      1.4MB

    • MD5

      942a88cb77eae630a1b630fb72895c21

    • SHA1

      b3aeba413fa2caa928f5e02d97f316dc424574e2

    • SHA256

      baee4a674b04576f9c58c7fdb3ebb71620d33a6fb8ab2ef539880384350e6c16

    • SHA512

      fbd5758eb630afd22365c762dc1d7b7710d9f0b0ecf54f0e8b6207b2242dead0d18cb34040dd1244212b0ea424565bf8c7ccc50e1c60e84a613c7b2f74bdc38c

    • SSDEEP

      24576:13dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:AmYqHU7pHYY00VcCDdowG3tMa6

    Score
    10/10
    discoverypikabotbotnet

    • PikaBot

      PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

      botnetpikabot

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks