Deep Dive: Pikabot (Loader)
Today we are analyzing the Pikabot malware family, which falls under the Loader category.
Overview
Pikabot is a malicious loader that emerged in early 2023, often compared to Qakbot due to similarities in its deployment techniques and code structure. It consists of a loader component and a core module that implements anti-analysis techniques to evade detection. Pikabot is typically distributed via malspam campaigns and is primarily used by threat actors to gain initial access to corporate networks before deploying secondary payloads, such as Cobalt Strike or ransomware (like Black Basta).
Known Aliases
Security vendors and researchers may refer to this family by several different names, including:
PikaBot
MITRE ATT&CK Techniques
This family has been observed utilizing the following techniques:
- T1566.002: View on MITRE
- T1059: View on MITRE
- T1106: View on MITRE
- T1105: View on MITRE
Frequently Asked Questions
What is Pikabot?
Pikabot is a malware loader that emerged in 2023, designed to compromise systems and serve as a beachhead for deploying secondary malware payloads into corporate networks.
Why is Pikabot often compared to Qakbot?
Security researchers have noted significant similarities between Pikabot and Qakbot in terms of their distribution methods (malspam), command-and-control communication structures, and their use in facilitating ransomware deployments.
What payloads does Pikabot typically deploy?
Once Pikabot secures a foothold on a network, it frequently deploys penetration testing tools like Cobalt Strike, which are then used by operators to move laterally and ultimately deploy ransomware such as Black Basta.
This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset and source code on GitHub, Hugging Face and Kaggle.
Top comments (0)