Rewterz Threat Alert – A New PikaBot Malware – Active IOCs

Severity

Medium

Analysis Summary

PikaBot is a sophisticated and highly evasive malware that targets Windows operating systems. This malware exhibits a range of malicious behaviors, including data exfiltration, remote command execution, and system persistence. It poses a significant threat to both individual users and organizations. PikaBot is classified as a Trojan malware, specifically a Remote Access Trojan (RAT). It enables unauthorized remote access to infected systems, allowing threat actors to gain control over the compromised machine. PikaBot is primarily distributed through phishing emails, malicious attachments, or compromised websites. Once executed, it employs various techniques, such as exploiting software vulnerabilities and social engineering, to infect target systems.

This malware ensures its persistence on infected machines through multiple means. It modifies registry entries, creates autorun entries, and establishes hidden services or scheduled tasks. These techniques enable the malware to maintain its presence across system reboots.

PikaBot establishes communication with its command and control server using various methods, including HTTP, DNS, or even legitimate service protocols. It utilizes encryption and obfuscation techniques to evade detection and hide its malicious activities. It is designed to steal sensitive information from infected systems. It can capture keystrokes, take screenshots, record audio, and collect stored credentials. The stolen data is typically transmitted to the attacker-controlled servers for further exploitation or monetization.

Impact

• Unauthorized Access
• Financial Theft 
• Information Theft

Indicators of Compromise

IP

• 15.235.47.206
• 15.235.202.109

MD5

• e62ca1ab3ae22b5e1b13f34b29b6d18a
• c947a9520d33becc6fd436d148c63ddd
• 8fe7dc3af5c74bf43f6a7a20ad88fa0d
• 982bafc924010364bd7476194d100274
• 1a29991d058791b29ef8b8ebaf6e036e
• 69668c6f99437573e6d5603476c34421

SHA-256

• 56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2
• 2459ef847a5d1dbf545aaf30b3758e4cbbfee13a87d1642fcb922f5af12782ee
• 63b3d18919359d1e4d0bd8b325d71bd3d72d6d0c10e84659b188a53a4948792e
• 23232a1df527b6e23a47634684a3b9f9902f64785ca9d7aa56d8f5c533e6deda
• 00dceb3bc7a64da6efb7eb28a43e52ac056053bb07254224d9121e8968c37f37
• 170a98b485ccf23969b2d5260101f437f6190f6be7512749d46e0c1fbe2ef61f

SHA-1

• acdd9b5f2b17e3d3b042515d440af94da26686b4
• 860885eb01a1177b9d7418eee987a970170dc316
• fde1579fe21407b14c803ce472d39dece44fa640
• c7b86e8f0120bfcf57eca37a4368c9fec4e74af2
• 320ba123e3931bc005324348df239430ce702088
• 55d362897b67bde5c56ba1e98f4900cda04d2f09

URL

• http://64.176.193.25/i1DQR/Serge
• http://64.176.212.255/jjku/pagan
• http://128.140.71.198/BN30m/Surfu

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution. Never trust or open links and attachments received from unknown sources/senders.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets.