|
It is not uncommon these days for threat actors to use malicious search ads to distribute malware. To do that, though, they would need to know how to bypass Google’s security measures by setting up decoy infrastructures.
PikaBot is one such malware that started gaining renown in early 2023. Malwarebytes Labs researchers conducted an in-depth analysis of the threat and published 11 indicators of compromise (IoCs)—two domains and nine IP addresses—in the process.
In a bid to make the Internet safer and more transparent, the WhoisXML API research team expanded the list of IoCs and found hundreds of potentially connected artifacts, namely:
A sample of the additional artifacts obtained from our analysis is available for download from our website.
As a first step, we looked at the two domains identified as IoCs via WHOIS lookups, which revealed that:
A bulk IP geolocation lookup, meanwhile, for the nine IP addresses tagged as IoCs showed that:
Threat Intelligence API searches for the IoCs also revealed interesting tidbits as detailed in the table below.
IoC | NUMBER OF ASSOCIATED THREATS | ASSOCIATED THREAT TYPE | DATE FIRST SEEN |
---|---|---|---|
139[.]99[.]222[.]29 | 1 | Malware | 15 December 2023 |
172[.]232[.]162[.]198 | 4 | Attack Botnet C2 Malware | 14 December 2023 |
172[.]232[.]164[.]77 | 4 | Attack Botnet C2 Malware | 13 December 2023 |
172[.]232[.]186[.]251 | 4 | Attack Botnet C2 Malware | 14 December 2023 |
54[.]37[.]79[.]82 | 4 | Attack Botnet C2 Malware | 15 December 2023 |
57[.]128[.]108[.]132 | 4 | Attack Botnet C2 Malware | 14 December 2023 |
57[.]128[.]109[.]221 | 4 | Attack Botnet C2 Malware | 15 December 2023 |
57[.]128[.]164[.]11 | 4 | Attack Botnet C2 Malware | 14 December 2023 |
57[.]128[.]83[.]129 | 4 | Attack Botnet C2 Malware | 14 December 2023 |
To uncover other possibly related PikaBot artifacts, we began by subjecting the two domains identified as IoCs to WHOIS history lookups, which revealed that one of them—ovmv[.]net—had four email addresses in their historical WHOIS records. Three of them were public email addresses.
Reverse WHOIS API queries using two of the three public email addresses as search terms led to the discovery of 112 domains after duplicates and the IoCs were removed, almost all of which were either Chinese-sounding or composed of random number combinations. Examples include:
Next, we performed DNS lookups on the two domains identified as IoCs and found three IP addresses that are not part of the original IoC list.
IP geolocation lookups for the three additional IP addresses revealed that:
We now had 12 IP addresses in total to work with—nine identified as IoCs and the three additional resolutions. Reverse IP lookups showed that three of them could be dedicated hosts. The potentially dedicated IP addresses hosted 210 other domains that were not yet part of the original IoC list nor email-connected.
Threat Intelligence API revealed that three of them—fakty-info[.]com, twinsources[.]shop, and txid-coinbase[.]net—were associated with various threats. Take a look at the details in the table below.
IP-CONNECTED DOMAIN | NUMBER OF ASSOCIATED THREATS | ASSOCIATED THREAT TYPE |
---|---|---|
fakty-info[.]com | 2 | Phishing Generic |
twinsources[.]shop | 1 | Malware |
txid-coinbase[.]net | 1 | Phishing |
To fill in possible gaps, we then sought to uncover other potentially connected domains via text string usage. We used Domains & Subdomains Discovery to find domains containing the string ovmv. using the Starts with parameter. We discovered 14 string-connected domains, all of which looked exactly as the IoC ovmv[.]net albeit using different top-level domain (TLD) extensions.
WHOIS comparisons with the domain ovmv[.]net, however, showed that none of them seemingly bore similarities with the IoC.
Our DNS deep dive into the PikaBot infrastructure allowed us to identify 339 possibly connected artifacts comprising 112 email-connected domains, three additional IP addresses, 210 IP-connected domains, and 14 string-connected domains. Additionally, our analysis enabled us to uncover five malicious web properties—two IP addresses (104[.]21[.]72[.]66 and 172[.]67[.]176[.]15) and three domains (fakty-info[.]com, twinsources[.]shop, and txid-coinbase[.]net).
If you wish to perform a similar investigation or learn more about the products used in this research, please don’t hesitate to contact us.
Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.
Sponsored byVerisign
Sponsored byIPv4.Global
Sponsored byVerisign
Sponsored byDNIB.com
Sponsored byWhoisXML API
Sponsored byCSC
Sponsored byRadix