MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aaf8dfa21057425dcc7a982aba8b0f9a3453e8d3d0eb2274023abfb9a89d8fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pikabot


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1aaf8dfa21057425dcc7a982aba8b0f9a3453e8d3d0eb2274023abfb9a89d8fb
SHA3-384 hash: 9a27c9b749280388d965ff1b3c443e844d7d8e04db6a767f140c8add9f18d4298c1136d55b9f6652736c636d7a1bb682
SHA1 hash: 10e683c178b89dfa0229fb2db85736cd8911de7a
MD5 hash: d1f556acd787ee0b046b8fc9263a5494
humanhash: quiet-lion-whiskey-alaska
File name:eumtd.html
Download: download sample
Signature Pikabot
Create hunting rule
File size:154'480 bytes
First seen:2023-12-06 16:58:44 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 3072:t7THUsHPAyvFP2bgdXprCOJhOl5mmvEjZz:FwEJvFP2bgdXZCsJmst
TLSH T188E36EF8091759A1C106F117E22E09629B74095B4F6876A8BE6E64A99FDDC1CFFF0C30
Reporter k3dg3___
Tags:html Pikabot ta577 tr

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
US US
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
89%
Tags:
cmd control lolbin obfuscated rundll32
Link:
https://www.filescan.io/uploads/6570a85a3636548f373e6359/reports/08bbe7fe-ce37-4265-ac0c-dcb2868243ed/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1aaf8dfa21057425dcc7a982aba8b0f9a3453e8d3d0eb2274023abfb9a89d8fb
Result
Verdict:
MALICIOUS
Result
Threat name:
CryptOne, PikaBot
Create hunting rule
Detection:
malicious
Classification:
phis.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1354809
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to check for running processes (XOR)
Contains functionality to detect sleep reduction / modifications
Detected javascript redirector / loader
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Snort IDS alert for network traffic
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected PikaBot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1354809 Sample: eumtd.html Startdate: 06/12/2023 Architecture: WINDOWS Score: 100 67 Snort IDS alert for network traffic 2->67 69 Antivirus detection for URL or domain 2->69 71 Antivirus detection for dropped file 2->71 73 5 other signatures 2->73 9 msiexec.exe 75 34 2->9         started        12 chrome.exe 16 2->12         started        process3 dnsIp4 51 C:\Windows\Installer\MSI4DCE.tmp, PE32 9->51 dropped 15 msiexec.exe 9->15         started        61 192.168.2.7, 123, 138, 2078 unknown unknown 12->61 63 192.168.2.22 unknown unknown 12->63 65 2 other IPs or domains 12->65 17 unarchiver.exe 5 12->17         started        19 chrome.exe 12->19         started        file5 process6 dnsIp7 22 rundll32.exe 10 15->22         started        26 cmd.exe 3 2 17->26         started        28 7za.exe 2 17->28         started        53 clients.l.google.com 142.251.16.139, 443, 49706 GOOGLEUS United States 19->53 55 172.253.115.101, 443, 49737 GOOGLEUS United States 19->55 57 5 other IPs or domains 19->57 process8 file9 43 C:\Windows\Installer\...\test.old.cs.dll, PE32 22->43 dropped 45 C:\Windows\Installer\...\WixSharp.dll, PE32 22->45 dropped 47 C:\Users\user\AppData\Local\...\tmp5966.dll, PE32 22->47 dropped 49 Microsoft.Deployme...indowsInstaller.dll, PE32 22->49 dropped 75 Contains functionality to detect sleep reduction / modifications 22->75 30 rundll32.exe 22->30         started        33 conhost.exe 26->33         started        35 msiexec.exe 3 26->35         started        37 conhost.exe 28->37         started        signatures10 process11 signatures12 79 Writes to foreign memory regions 30->79 81 Sample uses process hollowing technique 30->81 39 SearchFilterHost.exe 2 12 30->39         started        process13 dnsIp14 59 154.61.75.156, 2078, 49738 INTECHONLINE-INIntechOnlinePrivateLimitedIN United States 39->59 77 Contains functionality to check for running processes (XOR) 39->77 signatures15
Score:
100%
Verdict:
Malware
File Type:
ASCII
Link:
https://malprob.io/report/1aaf8dfa21057425dcc7a982aba8b0f9a3453e8d3d0eb2274023abfb9a89d8fb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1aaf8dfa21057425dcc7a982aba8b0f9a3453e8d3d0eb2274023abfb9a89d8fb/
Threat name:
Text.Trojan.PhishHtml
Create hunting rule
Status:
Malicious
First seen:
2023-12-06 20:18:34 UTC
AV detection:
4 of 36 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dkxy36rbav2clxghvgbkxkfq7grukpunhuhlej2aeov7xguj3d5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.36
Link:
https://yomi.yoroi.company/submissions/1aaf8dfa21057425dcc7a982aba8b0f9a3453e8d3d0eb2274023abfb9a89d8fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pikabot

html 1aaf8dfa21057425dcc7a982aba8b0f9a3453e8d3d0eb2274023abfb9a89d8fb

(this sample)

Pikabot

Microsoft Software Installer (MSI) msi f119f1e813cdb8dba30bd3348ef97cd8bf5213b3e1a9f25f008337e8b34eaee5

  
Dropping
SHA256 f119f1e813cdb8dba30bd3348ef97cd8bf5213b3e1a9f25f008337e8b34eaee5
  
Delivery method
Distributed via e-mail attachment

Comments