Loading malware…
Pikabot is a modular Windows loader and backdoor family first identified in 2023. It uses separate loader and core components to establish command-and-control communications, profile compromised hosts, execute attacker-supplied commands, and retrieve or inject additional payloads, including PE files and shellcode. It has been used to deliver Cobalt Strike and has featured in ransomware-enablement ecosystems.
Pikabot employs substantial defense evasion, including layered string encryption, runtime API resolution, anti-debugging and anti-virtualization checks, native or indirect system calls, in-memory loading, and process injection into legitimate Windows processes. Variants collect system, user, domain, display, memory, operating-system, and running-process information, and commonly avoid execution on systems configured for Russian or Ukrainian language settings. Some variants establish persistence through scheduled tasks or Windows startup mechanisms.
Pikabot has been distributed through phishing and malspam campaigns, frequently using hijacked email threads that lead victims to archives containing script-based downloaders. It has also been delivered through malvertising campaigns impersonating legitimate software downloads. TA577 has been observed delivering Pikabot, and Black Basta operators have reportedly evaluated or deployed it. The malware targets Windows systems and is associated with financially motivated intrusion activity and follow-on ransomware operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It was quickly nicknamed Pikabot. Pikabot consists of two components: loader/injector and core module. Core module then performs malicious behaviors, including gathering information about the victim machine, connecting to command and control server to receive and execute arbitrary commands, downloading and injecting other malware.
Specifically, our SOC frequently saw Black Basta sign Pikabot and Darkgate malware they used in phishing campaigns.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Use of Malicious Scripts – Executing scripts (e.g., ‘.vbs’, ‘.msi’) to establish persistence.
The obfuscated JavaScript downloads and executes PIKABOT’s loader using PowerShell and Invoke-WebRequest.
Multiple bot command IDs provide command-line execution with output.
VBS Downloaders leverage Visual Basic runtime applications, usually available within Windows environments, to carry out the download and execution of malware binaries.
The malware executes syscalls directly, bypassing conventional API calls; it hashes Zw API names, extracts syscall IDs from NTDLL, and uses Wow64Transition to execute in 64-bit mode.
The malicious code employs heavy obfuscation, utilizing a technique where a JMP follows each assembly instruction; the core also uses junk instructions and obfuscated global variables.
The loader populates a global variable with addresses of essential APIs, while the core parses the PEB and uses API hashing to resolve needed libraries at runtime.
To further hide the core module the binary has been built to mimic a legitimate SearchProtocolHost.exe binary including some of the plain text strings in the binary.
Bot commands include PE injection in a remote process (0x36C) and shellcode injection in a remote process (0x792).
The loader creates a suspended ctfmon.exe process, allocates remote memory, writes the PIKABOT core, changes the thread execution address using SetContextThread, and resumes the thread.
Once decrypted we can see that they are Base64 encoded PowerShell commands ... Get-Content ... | %{[Convert]::FromBase64String($_)}; Set-Content ... -Encoding Byte;
regsvr32 /s $env:APPDATA\Microsoft\nonresistantOutlivesDictatorial\AphroniaHaimavati.dll;
After the language check, PIKABOT creates a mutex to prevent reinfection on the same machine.
0x5a10ab: HARDWARE\ACPI\DSDT\VBOX__ | HARDWARE\ACPI\DSDT\VBOX__
The malware was tagged as a peexe, long-sleeps, spreader, detect-debug-environment, service-scan, overlay, revoked-cert, signed and checks-user-input.
The core retrieves the name of the user associated with the PIKABOT thread and generates a victim UUID using the hostname and username.
The malware was tagged as a peexe, long-sleeps, spreader, detect-debug-environment, service-scan, overlay, revoked-cert, signed and checks-user-input.
PIKABOT uses CreateToolhelp32Snapshot to retrieve process information; it also enumerates processes through command ID 0x985.
PIKABOT collects processor, display-device, memory, Windows product/version, domain-controller, username, computer-name, and process information.
0x5a10ab: HARDWARE\ACPI\DSDT\VBOX__ | HARDWARE\ACPI\DSDT\VBOX__
The malware was tagged as a peexe, long-sleeps, spreader, detect-debug-environment, service-scan, overlay, revoked-cert, signed and checks-user-input.
The file triggered the following high IDS rules: - ET CNC Feodo Tracker Reported CnC Server group 1 - ET CNC Feodo Tracker Reported CnC Server group 2
PIKABOT performs network communication over HTTPS on non-traditional ports and sends HTTP POST check-in requests to C2 URI paths.
PIKABOT performs HTTPS network communication on non-traditional ports including 2967 and 2223.
PowerShell Invoke-WebRequest downloads a .dat payload from gloverstech[.]com and saves it as Jrdhtjydhjf.exe.
110 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
108 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example botnet distributed via drive-by download techniques.
Pikabot2
A malware family in the dropper/loader ecosystem referenced as a prior law-enforcement target.
Loader malware whose infrastructure was targeted in prior Operation Endgame actions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.