🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pikabot


Vendor detections: 12


Intelligence 12 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
SHA3-384 hash: 27a5d8f8ed8a8fb64a3d8f53c56385ae223070ecc18ce8460b19ec13ff035d4bf064ccfc5f31778b9b54d0ec87447f40
SHA1 hash: 183b74ec94b19c1f4af194e4d606270053669913
MD5 hash: 4b1518535af6344af39bd90aa02a6c0d
humanhash: emma-west-three-two
File name:6772.png
Download: download sample
Signature Pikabot
Create hunting rule
File size:860'160 bytes
First seen:2024-03-06 16:12:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 55f1ba0b782341fa929d61651ef47f0c (3 x Pikabot)
ssdeep 24576:je9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:qBmpSVmLfCDfPJ4cDFPhmghE
TLSH T1DA05B02138C2C072E67E213B85A9F77519AEE8310F3097EF5BD8067A6F346C15A35627
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter proxylife
Tags:dll Pikabot

Intelligence

File Origin
# of uploads :
1
# of downloads :
540
Origin country :
DE DE
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint lolbin masquerade packed shell32
Link:
https://www.filescan.io/uploads/65e89611b4fd15550487d644/reports/85ddc1f8-5c9d-480b-af36-7406cf1bf869/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/21799921-ea86-4e83-9521-ab5ca20df460
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1404219
Signature
Connects to many ports of the same IP (likely port scanning)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Sigma detected: Execute DLL with spoofed extension
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1404219 Sample: 6772.png.dll Startdate: 06/03/2024 Architecture: WINDOWS Score: 56 46 Sigma detected: Execute DLL with spoofed extension 2->46 48 Connects to many ports of the same IP (likely port scanning) 2->48 8 loaddll32.exe 1 2->8         started        process3 signatures4 50 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->50 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        15 rundll32.exe 8->15         started        17 15 other processes 8->17 process5 process6 19 rundll32.exe 11->19         started        21 ctfmon.exe 13->21         started        23 WerFault.exe 13->23         started        25 ctfmon.exe 15->25         started        27 ctfmon.exe 17->27         started        29 ctfmon.exe 17->29         started        31 ctfmon.exe 17->31         started        33 10 other processes 17->33 process7 35 ctfmon.exe 19->35         started        38 WerFault.exe 22 16 19->38         started        dnsIp8 40 94.72.104.77, 13724, 49743 MARSOFT-ASPL Poland 35->40 42 154.12.236.248, 13786, 49744 COGENT-174US United States 35->42 44 6 other IPs or domains 35->44
Score:
54%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646/
Threat name:
Win32.Trojan.Pikabot
Create hunting rule
Status:
Malicious
First seen:
2024-03-06 16:13:09 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eog4yvqr5wignnr5fuaqtsnwep2u7dl3mhk7txsznfgpyyfe4zda._file
Result
Malware family:
pikabot
Create hunting rule
Score:
  10/10
Tags:
family:pikabot botnet
Link:
https://tria.ge/reports/240306-tn3crsda7t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
PikaBot
Malware Config
C2 Extraction:
154.53.55.165
158.247.240.58
154.12.236.248
Unpacked files
SH256 hash:
238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
MD5 hash:
4b1518535af6344af39bd90aa02a6c0d
SHA1 hash:
183b74ec94b19c1f4af194e4d606270053669913
Detections:
win_blacksoul_auto
Create hunting rule
Link:
https://www.unpac.me/results/97524548-c676-40f8-929f-a5645732e25d/
Malware family:
SysWhispers
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/238dcc5611ed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Windows_Generic_Threat_1417511b
Create hunting rule
Author:Elastic Security
Rule name:win_blacksoul_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.blacksoul.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorA
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll::ConvertStringSidToSidA
ADVAPI32.dll::GetNamedSecurityInfoA
ADVAPI32.dll::SetEntriesInAclA
ADVAPI32.dll::SetNamedSecurityInfoA
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetSecurityDescriptorDacl
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW

Comments