pikabot | 9b8ffdc8ba2b2caa485cca56a82b2dcbd251f65fb30bc88f0ac3da6704e4d3c6 | Triage

Sharing

General

Target

idggh934sp.dll
Size

1.2MB
Sample

241122-r3ya9asnes
MD5

2bf6280ce1a1ec314e08b988ed8c8050
SHA1

1be1785a3e4a1aeda89bc2a5b26df7edc7fe1430
SHA256

9b8ffdc8ba2b2caa485cca56a82b2dcbd251f65fb30bc88f0ac3da6704e4d3c6
SHA512

340b5192b117efcbb18c38ef8de6982da2e5d1b1cec5d080b5a98853c39aa05a03da20d0824aeda9cbdb74762fe12139536a5f2ee87a37cbbe9b93fa6ec17d4e
SSDEEP

24576:tvr+qtKbfCGLovhM2he3og6p6tOs1CTvmO4Kr5x+1kxjq0cnccy:M5CPjKjLCTvm0oqxdv

Score

10^/10

pikabot botnet discovery persistence

Malware Config

Targets

- Target
  
  idggh934sp.dll
- Size
  
  1.2MB
- MD5
  
  2bf6280ce1a1ec314e08b988ed8c8050
- SHA1
  
  1be1785a3e4a1aeda89bc2a5b26df7edc7fe1430
- SHA256
  
  9b8ffdc8ba2b2caa485cca56a82b2dcbd251f65fb30bc88f0ac3da6704e4d3c6
- SHA512
  
  340b5192b117efcbb18c38ef8de6982da2e5d1b1cec5d080b5a98853c39aa05a03da20d0824aeda9cbdb74762fe12139536a5f2ee87a37cbbe9b93fa6ec17d4e
- SSDEEP
  
  24576:tvr+qtKbfCGLovhM2he3og6p6tOs1CTvmO4Kr5x+1kxjq0cnccy:M5CPjKjLCTvm0oqxdv
Score

10^/10

discovery pikabot botnet persistence
- Detects PikaBot botnet
- PikaBot
  PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
  botnet pikabot
- Pikabot family
  pikabot
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

pikabotbotnetdiscoverypersistence