Pikabot Returns With Layered Obfuscation, Process Injection, and Loader Automation

Researchers detailed how Pikabot has evolved into a heavily obfuscated malware loader and core backdoor that uses layered string protection, dynamic API resolution, anti-analysis checks, and stealthy process injection. Recent reverse-engineering shows Pikabot decrypts strings through per-string RC4, modified Base64, and AES-CBC, while newer tooling can now automate recovery of keys, IVs, and encrypted arrays from samples. Analysts said the malware disguises itself as SearchProtocolHost.exe, walks the PEB to locate kernel32.dll, hashes API names, and uses indirect syscalls such as NtAllocateVirtualMemory, NtWriteVirtualMemory, and NtResumeThread to inject its core module into a suspended legitimate process.

The recovered functionality shows Pikabot can profile hosts, enumerate processes, execute commands, manipulate files and the registry, and communicate with command-and-control servers over WinINet using HTTP POST requests. Earlier loader samples also established persistence with a scheduled task and a registry-stored PowerShell downloader that fetched a DLL, decoded it from Base64, and launched it with regsvr32, while newer samples extracted payload components from PNG resources before decryption and injection. Reporting on distribution linked Pikabot to spam thread-hijacking campaigns, malicious attachments and links, and malvertising that impersonated AnyDesk, with operators using commands such as whoami.exe /all, ipconfig.exe /all, and netstat.exe -aon to survey compromised systems.