Loading malware…
Pikabot is a modular Windows malware loader first observed in 2023 that provides initial access and delivers additional payloads for financially motivated intrusions. It comprises loader and core components and supports arbitrary command execution, downloading and executing executable and DLL payloads, shellcode execution, and remote process injection. Pikabot has delivered Cobalt Strike and supported intrusion chains leading to Black Basta ransomware. It has been used by Water Curupira and TA577 in large-scale malicious email campaigns targeting organizations across multiple industries.
Distribution commonly relies on phishing and malspam that hijack existing email conversations. Infection chains use malicious links, password-protected archives, PDF attachments, obfuscated JavaScript downloaders, and shortcuts disguised as documents. Some campaigns restrict payload downloads according to browser and geographic criteria. Downloaders abuse legitimate Windows utilities and PowerShell to retrieve and execute the loader.
Pikabot employs extensive defense evasion, including control-flow obfuscation, encrypted strings, runtime API resolution, anti-debugging checks, and sandbox and virtual-machine detection. Variants reconstruct encrypted payloads from embedded resources or scattered data chunks, load components in memory, and inject the core into suspended legitimate Windows processes. Direct or indirect system calls help bypass conventional user-mode monitoring. Analyzed variants terminate on systems configured with Russian or Ukrainian language identifiers. Some loader variants establish scheduled-task persistence and store a PowerShell downloader in the registry.
The core profiles infected systems, collecting operating-system, hardware, user, domain, network, and running-process information for transmission to command-and-control infrastructure. Its encrypted HTTP or HTTPS protocol has changed between versions: earlier implementations used AES-CBC and JSON-formatted data, while a later variant used RC4 with an additional byte transformation. Operators can issue commands, deliver further payloads, and adjust beacon intervals. Pikabot infrastructure was targeted during the multinational Operation Endgame disruption in May 2024.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Pikabot is a type of loader malware that was actively used in spam campaigns by a threat actor we track under the Intrusion set Water Curupira in the first quarter of 2023.
“Pikabot:” Loader malware with extensive defense evasion capabilities.
It was quickly nicknamed Pikabot. Pikabot consists of two components: loader/injector and core module. Core module then performs malicious behaviors, including gathering information about the victim machine, connecting to command and control server to receive and execute arbitrary commands, downloading and injecting other malware.
73 distinct techniques documented for this family, organized by ATT&CK tactic.
PikaBot, a stealthy malware normally distributed via malspam is now being spread via malicious ads... we have seen an increase in the use of malicious ads (malvertising) and specifically those via search engines, to drop malware targeting businesses.
These include hijacked email threads as the initial infection, URLs with unique patterns that limit user access, and an infection chain nearly identical to what we have seen with QakBot delivery.
Over the past few years, cybercriminals have increasingly used the drive-by download technique to distribute malware via user web browsing.
The February 8 campaign involved emails with hyperlinks that led to ZIP archive files containing a malicious obfuscated JavaScript script.
Malicious Attachments – Crafting deceptive messages to circumvent security measures.
The campaign begins with a hijacked email thread to bait users into interacting with a URL that has added layers that limit access to the malicious payload only to users that meet specific requirements set by the threat actors.
schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 1
Use of Malicious Scripts – Executing scripts (e.g., ‘.vbs’, ‘.msi’) to establish persistence.
The obfuscated JavaScript downloads and executes PIKABOT’s loader using PowerShell and Invoke-WebRequest.
[Pikabot](https://attack.mitre.org/software/S1145) can execute Windows shell commands via <code>cmd.exe</code>.(Citation: Zscaler Pikabot 2023)
VBS Downloaders leverage Visual Basic runtime applications, usually available within Windows environments, to carry out the download and execution of malware binaries.
JavaScript in Malware – Leveraged for execution and persistence.
[Pikabot](https://attack.mitre.org/software/S1145) uses native Windows APIs to determine if the process is being debugged and analyzed, such as `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`, `ProcessDebugPort`, and `ProcessDebugFlags`.(Citation: Zscaler Pikabot 2023) Other [Pikabot](https://attack.mitre.org/software/S1145) variants populate a global list of Windows API addresses from the `NTDLL` and `KERNEL32` libraries, and references these items instead of calling the API items to obfuscate execution.(Citation: Elastic Pikabot 2024)
commands we have identified so far are as follows: dll Fetch and run DLL
Once the victim downloads and opens the malicious XLL file, Excel prompts them to enable the add-in, triggering the execution of a malicious DLL within the Excel process.
Emails with hyperlinks led to ZIP archive files containing a malicious obfuscated JavaScript script.
Once the victim downloads and opens the malicious XLL file, Excel prompts them to enable the add-in...
schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 1
Command ID 0x246F creates a file on disk and modifies registry data tied to configuration.
Decrypted: b'CreateProcessW' ... Decrypted: b'InitializeProcThreadAttributeList' ... Decrypted: b'UpdateProcThreadAttribute'
The powershell script (see above) is stored in the registry and is then retrieved by the scheduled task powershell and executed.
[Pikabot](https://attack.mitre.org/software/S1145) maintains persistence following system checks through the Run key in the registry.(Citation: Zscaler Pikabot 2023)
LNK Downloader is a Microsoft LNK shortcut downloader that abuses the trusted nature of being a “safe” file format to secure entry to a victim’s computer before downloading and executing a malware payload.
schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 1
Bot commands include PE injection in a remote process (0x36C) and shellcode injection in a remote process (0x792).
[Pikabot](https://attack.mitre.org/software/S1145), following payload decryption, creates a process hard-coded into the dropped (e.g., WerFault.exe) and injects the decrypted core modules into it.(Citation: Zscaler Pikabot 2023)
[Pikabot](https://attack.mitre.org/software/S1145) can create a suspended instance of a legitimate process (e.g., ctfmon.exe), allocate memory within the suspended process corresponding to [Pikabot](https://attack.mitre.org/software/S1145)'s core module, then redirect execution flow via `SetContextThread` API so that when the thread resumes the [Pikabot](https://attack.mitre.org/software/S1145) core module is executed.(Citation: Elastic Pikabot 2024)
The loader creates a suspended ctfmon.exe process, allocates remote memory, writes the PIKABOT core, changes the thread execution address using SetContextThread, and resumes the thread.
Decrypted: b'CreateProcessW' ... Decrypted: b'InitializeProcThreadAttributeList' ... Decrypted: b'UpdateProcThreadAttribute'
The powershell script (see above) is stored in the registry and is then retrieved by the scheduled task powershell and executed.
[Pikabot](https://attack.mitre.org/software/S1145) maintains persistence following system checks through the Run key in the registry.(Citation: Zscaler Pikabot 2023)
LNK Downloader is a Microsoft LNK shortcut downloader that abuses the trusted nature of being a “safe” file format to secure entry to a victim’s computer before downloading and executing a malware payload.
The malicious code employs heavy obfuscation, utilizing a technique where a JMP follows each assembly instruction; the core also uses junk instructions and obfuscated global variables.
In order to slow down the code analysis, Pikabot inserts a large number of meaningless junk functions into the execution flow. These functions typically do nothing.
[Pikabot](https://attack.mitre.org/software/S1145) loads a set of PNG images stored in the malware's resources section (RCDATA), each with an encrypted section containing portions of the core [Pikabot](https://attack.mitre.org/software/S1145) core module. These sections are loaded and decrypted using a bitwise XOR operation with a hardcoded 32 bit key.(Citation: Zscaler Pikabot 2023)
The loader populates a global variable with addresses of essential APIs, while the core parses the PEB and uses API hashing to resolve needed libraries at runtime.
[Pikabot](https://attack.mitre.org/software/S1145) further decrypts information embedded via steganography using AES-CBC with the same 32 bit key as initial XOR operations combined with the first 16 bytes of the encrypted data as an initialization vector.(Citation: Zscaler Pikabot 2023) Other [Pikabot](https://attack.mitre.org/software/S1145) variants include encrypted, chunked sections of the stage 2 payload in the initial loader <code>.text</code> section before decrypting and assembling these during execution.(Citation: Elastic Pikabot 2024)
Some versions of [Pikabot](https://attack.mitre.org/software/S1145) build the final PE payload in memory to avoid writing contents to disk on the executing machine.(Citation: Elastic Pikabot 2024)
At the start of the DLL the key is RC4 decrypted: 1EmXwEpOYt6Cf8GyJVGXYUaqPnUapVrk The decryption seems to be AES 256, but need to check further.
To further hide the core module the binary has been built to mimic a legitimate SearchProtocolHost.exe binary including some of the plain text strings in the binary.
Bot commands include PE injection in a remote process (0x36C) and shellcode injection in a remote process (0x792).
[Pikabot](https://attack.mitre.org/software/S1145), following payload decryption, creates a process hard-coded into the dropped (e.g., WerFault.exe) and injects the decrypted core modules into it.(Citation: Zscaler Pikabot 2023)
[Pikabot](https://attack.mitre.org/software/S1145) can create a suspended instance of a legitimate process (e.g., ctfmon.exe), allocate memory within the suspended process corresponding to [Pikabot](https://attack.mitre.org/software/S1145)'s core module, then redirect execution flow via `SetContextThread` API so that when the thread resumes the [Pikabot](https://attack.mitre.org/software/S1145) core module is executed.(Citation: Elastic Pikabot 2024)
The loader creates a suspended ctfmon.exe process, allocates remote memory, writes the PIKABOT core, changes the thread execution address using SetContextThread, and resumes the thread.
MITRE ATT&CK TTPs Technique Tactic ... Impair Defenses: File Deletion (T1070.004)
[Pikabot](https://attack.mitre.org/software/S1145) decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm.(Citation: Zscaler Pikabot 2023) Other versions of [Pikabot](https://attack.mitre.org/software/S1145) decode chunks of stored stage 2 payload content in the initial payload <code>.text</code> section before consolidating them for further execution.(Citation: Elastic Pikabot 2024) Overall [LunarMail](https://attack.mitre.org/software/S1142) is associated with multiple encoding and encryption mechanisms to obfuscate the malware's presence and avoid analysis or detection.(Citation: Logpoint Pikabot 2024)
PikaBot’s loader also hides its injection by using indirect syscalls, making the malware very stealthy.
regsvr32 /s $env:APPDATA\Microsoft\nonresistantOutlivesDictatorial\AphroniaHaimavati.dll;
regsvr32 /s $env:APPDATA\Microsoft\nonresistantOutlivesDictatorial\AphroniaHaimavati.dll;
It then executes the paylod (DLL) via rundll32 : rundll32 C:\Gkooegsglitrg\Dkrogirbksri\Wkkfgujbsrbuj.dll,Enter
[Pikabot](https://attack.mitre.org/software/S1145) stops execution if the infected system language matches one of several languages, with various versions referencing: Georgian, Kazakh, Uzbek, Tajik, Russian, Ukrainian, Belarussian, and Slovenian.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)
After the language check, PIKABOT creates a mutex to prevent reinfection on the same machine.
0x5a10ab: HARDWARE\ACPI\DSDT\VBOX__ | HARDWARE\ACPI\DSDT\VBOX__
[Pikabot](https://attack.mitre.org/software/S1145) performs a variety of system checks to determine if it is running in an analysis environment or sandbox, such as checking the number of processors (must be greater than two), and the amount of RAM (must be greater than 2GB).(Citation: Elastic Pikabot 2024)
[Pikabot](https://attack.mitre.org/software/S1145) reflectively loads stored, previously encrypted components of the PE file into memory of the currently executing process to avoid writing content to disk on the executing machine.(Citation: Elastic Pikabot 2024)
[Pikabot](https://attack.mitre.org/software/S1145) features several methods to evade debugging by analysts, including checks for active debuggers, the use of breakpoints during execution, and checking various system information items such as system memory and the number of processors.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)(Citation: Logpoint Pikabot 2024)
Command ID 0x246F creates a file on disk and modifies registry data tied to configuration.
We identified a malware signed with a SSL.com EV Code Signing Intermediate CA RSA R3 certificate.
MITRE ATT&CK TTPs Technique Tactic Collection Archive Collected Data (T1560) Input Capture (T1056)
[Pikabot](https://attack.mitre.org/software/S1145) gathers victim network information through commands such as <code>ipconfig</code> and <code>ipconfig /all</code>.(Citation: Zscaler Pikabot 2023)
The core retrieves the name of the user associated with the PIKABOT thread and generates a victim UUID using the hostname and username.
The malware was tagged as a peexe, long-sleeps, spreader, detect-debug-environment, service-scan, overlay, revoked-cert, signed and checks-user-input.
netstat.exe -aon
PIKABOT uses CreateToolhelp32Snapshot to retrieve process information; it also enumerates processes through command ID 0x985.
[Pikabot](https://attack.mitre.org/software/S1145) performs a variety of system checks and gathers system information, including commands such as <code>whoami</code>.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)
Decrypted: b'GetFileAttributesW' ... Decrypted: b'ExpandEnvironmentStringsW' ... Decrypted: b'%appdata%\\Microsoft\\'
[Pikabot](https://attack.mitre.org/software/S1145) will retrieve the name of the user associated with the thread under which the malware is executing.(Citation: Elastic Pikabot 2024)
[Pikabot](https://attack.mitre.org/software/S1145) will gather information concerning the Windows Domain the victim machine is a member of during execution.(Citation: Elastic Pikabot 2024)
0x5a10ab: HARDWARE\ACPI\DSDT\VBOX__ | HARDWARE\ACPI\DSDT\VBOX__
[Pikabot](https://attack.mitre.org/software/S1145) performs a variety of system checks to determine if it is running in an analysis environment or sandbox, such as checking the number of processors (must be greater than two), and the amount of RAM (must be greater than 2GB).(Citation: Elastic Pikabot 2024)
MITRE ATT&CK TTPs Technique Tactic ... Software Discovery: Security Software Discovery (T1518)
PIKABOT verifies GetUserDefaultLangID and immediately stops execution if the language is Russian (0x419) or Ukrainian (0x422).
[Pikabot](https://attack.mitre.org/software/S1145) features several methods to evade debugging by analysts, including checks for active debuggers, the use of breakpoints during execution, and checking various system information items such as system memory and the number of processors.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)(Citation: Logpoint Pikabot 2024)
It excludes CIS countries based on the configured language ID of the infected system
MITRE ATT&CK TTPs Technique Tactic Collection Archive Collected Data (T1560) Input Capture (T1056)
This URL downloads a ZIP archive that contains a JS file that is a JS Dropper
Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.
Cobian RAT obfuscates communications with the C2 server using Base64 encoding... Daserf uses custom base64 encoding to obfuscate HTTP traffic... Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.
The file triggered the following high IDS rules: - ET CNC Feodo Tracker Reported CnC Server group 1 - ET CNC Feodo Tracker Reported CnC Server group 2
PIKABOT performs network communication over HTTPS on non-traditional ports and sends HTTP POST check-in requests to C2 URI paths.
PIKABOT performs HTTPS network communication on non-traditional ports including 2967 and 2223.
PowerShell Invoke-WebRequest downloads a .dat payload from gloverstech[.]com and saves it as Jrdhtjydhjf.exe.
Traffic consists of exchanging JSON blobs over HTTPS, with the payload encrypted using Base64+AES-CBC
[Pikabot](https://attack.mitre.org/software/S1145) uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)
[Pikabot](https://attack.mitre.org/software/S1145) uses non-standard ports, such as 2967, 2223, and others, for HTTPS command and control communication.(Citation: Elastic Pikabot 2024)
Traffic consists of exchanging JSON blobs over HTTPS, with the payload encrypted using Base64+AES-CBC
Earlier [Pikabot](https://attack.mitre.org/software/S1145) variants use a custom encryption procedure leveraging multiple mechanisms including AES with multiple rounds of Base64 encoding for its command and control communication.(Citation: Zscaler Pikabot 2023) Later [Pikabot](https://attack.mitre.org/software/S1145) variants eliminate the use of AES and instead use RC4 encryption for transmitted information.(Citation: Elastic Pikabot 2024)
During the initial [Pikabot](https://attack.mitre.org/software/S1145) command and control check-in, [Pikabot](https://attack.mitre.org/software/S1145) will transmit collected system information encrypted using RC4.(Citation: Elastic Pikabot 2024)
128 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
112 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.