SYMBOLCOMMON_NAMEaka. SYNONYMS
win.pikabot (Back to overview)

Pikabot

VTCollection    

Introducing Pikabot, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. Despite being in the early stages of development, it already demonstrates advanced techniques in evasion, injection, and anti-analysis. Notably, the loader component incorporates an array of sophisticated anti-debugging and anti-VM measures inspired by the open-source Al-Khaser project, while leveraging steganography to conceal its payload. Additionally, Pikabot utilizes a proprietary C2 framework and supports a diverse range of commands, encompassing host enumeration and advanced secondary payload injection options.

References
2025-06-17 ⋅ DARKReading ⋅ James Shank
Operation Endgame: Do Takedowns and Arrests Matter?
BumbleBee Emotet Pikabot SmokeLoader TrickBot
2024-11-20 ⋅ Intrinsec ⋅ Equipe CTI
PROSPERO & Proton66: Tracing Uncovering the links between bulletproof networks
Coper SpyNote FAKEUPDATES GootLoader EugenLoader IcedID Matanbuchus Nokoyawa Ransomware Pikabot
2024-10-04 ⋅ VirusBulletin ⋅ Emre Güler
TA577 walked just past you: indirect syscalls in Pikabot
Pikabot
2024-07-02 ⋅ Sekoia ⋅ Quentin Bourgue
Exposing FakeBat loader: distribution methods and adversary infrastructure
BlackCat Royal Ransom EugenLoader Carbanak Cobalt Strike DICELOADER Gozi IcedID Lumma Stealer NetSupportManager RAT Pikabot RedLine Stealer SectopRAT Sliver SmokeLoader Vidar
2024-06-03 ⋅ Sekoia ⋅ Pierre Le Bourhis, Quentin Bourgue, Sekoia TDR
PikaBot: a Guide to its Deep Secrets and Operations
Pikabot
2024-04-08 ⋅ Zscaler ⋅ Nikolaos Pantazopoulos
Automating Pikabot’s String Deobfuscation
Pikabot
2024-03-10 ⋅ Krakz ⋅ Pierre Le Bourhis
SysWhispers2 analysis
Pikabot
2024-02-28 ⋅ Security Intelligence ⋅ Golo Mühr, Ole Villadsen
X-Force data reveals top spam trends, campaigns and senior superlatives in 2023
404 Keylogger Agent Tesla Black Basta DarkGate Formbook IcedID Loki Password Stealer (PWS) Pikabot QakBot Remcos
2024-02-28 ⋅ VMRay ⋅ VMRay Labs Team
Just Carry A Ladder: Why Your EDR Let Pikabot Jump Through
Pikabot
2024-02-26 ⋅ cyber5w ⋅ Amr Ashraf
Pikabot Loader Detailed Analysis
Pikabot
2024-02-23 ⋅ Elastic ⋅ Daniel Stepanic, Salim Bitam
PIKABOT, I choose you!
Pikabot
2024-02-12 ⋅ Zscaler ⋅ Nikolaos Pantazopoulos
The (D)Evolution of Pikabot
Pikabot
2024-02-05 ⋅ YouTube (John Hammond) ⋅ John Hammond, Ryan Chapman
PikaBot Malware Analysis: Debugging in Visual Studio
Pikabot
2024-01-22 ⋅ Pulsedive ⋅ Pulsedive
Pikabot distirbution methods and capabilities
Pikabot
2024-01-21 ⋅ YouTube (Embee Research) ⋅ Embee_research
Manual Malware Decoding With Procmon - Pikabot
Pikabot
2024-01-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q4 2023
FluBot Hook FAKEUPDATES AsyncRAT BianLian Cobalt Strike DCRat Havoc IcedID Lumma Stealer Meterpreter NjRAT Pikabot QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver
2024-01-09 ⋅ Trend Micro ⋅ Arianne Dela Cruz, Charles Steven Derion, Francisrey Joshua Castillo, Henry Salcedo, Ian Kenefick, John Carlo Marquez, John Rainier Navato, Joshua Aquino, Juhn Emmanuel Atanque, Raymart Yambot, Shinji Robert Arasawa
Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign
Pikabot Water Curupira
2024-01-06 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
[QuickNote] Technical Analysis of recent Pikabot Core Module
Pikabot
2023-12-26 ⋅ Github (VenzoV) ⋅ VenzoV
Pikabot Loader analysis, round 2!
Pikabot
2023-12-15 ⋅ Malwarebytes Labs ⋅ Jérôme Segura
PikaBot distributed via malicious search ads
Pikabot
2023-11-20 ⋅ Cofense ⋅ Dylan Duncan
Are DarkGate and PikaBot the new QakBot?
DarkGate Pikabot QakBot
2023-11-19 ⋅ OALabs ⋅ OALabs
PikaBot Is Back With a Vengeance - Part 2
Pikabot
2023-11-12 ⋅ OALabs ⋅ OALabs
PikaBot Is Back With a Vengeance
Pikabot
2023-10-03 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
2023-10-03 (Tuesday) - PikaBot infection with Cobalt Strike
Cobalt Strike Pikabot
2023-09-21 ⋅ Security Onion ⋅ Security Onion
Quick Malware Analysis: PIKABOT INFECTION WITH COBALT STRIKE pcap from 2023-05-23
Pikabot
2023-07-31 ⋅ d01a ⋅ Mohamed Adel
Pikabot deep analysis
Pikabot QakBot
2023-06-12 ⋅ Sophos ⋅ Karl Ackerman
Deep dive into the Pikabot cyber threat
Pikabot
2023-05-25 ⋅ Hive Pro ⋅ Hive Pro
Pikabot A Stealthy Backdoor with Ingenious Evasion Tactics
Pikabot
2023-05-24 ⋅ Zscaler ⋅ Brett Stone-Gross, Nikolaos Pantazopoulos
Technical Analysis of Pikabot
Pikabot
2023-02-26 ⋅ OALabs ⋅ Sergei Frankoff
PikaBot Tiny loader that seems very familiar
Pikabot
2023-02-13 ⋅ Minerva Labs ⋅ Natalie Zargarov
Beepin’ Out of the Sandbox: Analyzing a New, Extremely Evasive Malware
Pikabot
2023-02-10 ⋅ DCSO ⋅ Axel Wauer, Johann Aydinbas
#ShortAndMalicious — PikaBot and the Matanbuchus connection
Pikabot
Yara Rules
[TLP:WHITE] win_pikabot_auto (20260917 | Detects win.pikabot.)
rule win_pikabot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.pikabot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ebd3 8b4508 c9 c3 }
            // n = 4, score = 1100
            //   ebd3                 | jmp                 0xffffffd5
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   c9                   | leave               
            //   c3                   | ret                 

        $sequence_1 = { 40 8945fc 8b45f8 40 8945f8 ebd3 }
            // n = 6, score = 1000
            //   40                   | inc                 eax
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   40                   | inc                 eax
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   ebd3                 | jmp                 0xffffffd5

        $sequence_2 = { 48 894510 837df400 741a }
            // n = 4, score = 1000
            //   48                   | dec                 eax
            //   894510               | mov                 dword ptr [ebp + 0x10], eax
            //   837df400             | cmp                 dword ptr [ebp - 0xc], 0
            //   741a                 | je                  0x1c

        $sequence_3 = { 8945f8 8b4510 8945f4 8b4510 }
            // n = 4, score = 1000
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]

        $sequence_4 = { 8b4df8 8a09 8808 8b45fc }
            // n = 4, score = 1000
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8a09                 | mov                 cl, byte ptr [ecx]
            //   8808                 | mov                 byte ptr [eax], cl
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_5 = { 837df400 741a 8b45fc 8b4df8 }
            // n = 4, score = 1000
            //   837df400             | cmp                 dword ptr [ebp - 0xc], 0
            //   741a                 | je                  0x1c
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]

        $sequence_6 = { 83ec0c 8b4508 8945fc 8b450c 8945f8 8b4510 }
            // n = 6, score = 1000
            //   83ec0c               | sub                 esp, 0xc
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]

        $sequence_7 = { 7ce9 8b4214 2b420c 5f }
            // n = 4, score = 900
            //   7ce9                 | jl                  0xffffffeb
            //   8b4214               | mov                 eax, dword ptr [edx + 0x14]
            //   2b420c               | sub                 eax, dword ptr [edx + 0xc]
            //   5f                   | pop                 edi

        $sequence_8 = { e8???????? ffd0 c9 c3 55 8bec }
            // n = 6, score = 900
            //   e8????????           |                     
            //   ffd0                 | call                eax
            //   c9                   | leave               
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp

        $sequence_9 = { 8a1c08 8d4320 0fb6c8 8d53bf }
            // n = 4, score = 800
            //   8a1c08               | mov                 bl, byte ptr [eax + ecx]
            //   8d4320               | lea                 eax, [ebx + 0x20]
            //   0fb6c8               | movzx               ecx, al
            //   8d53bf               | lea                 edx, [ebx - 0x41]

        $sequence_10 = { b84d5a0000 57 8955fc 663906 }
            // n = 4, score = 700
            //   b84d5a0000           | mov                 eax, 0x5a4d
            //   57                   | push                edi
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   663906               | cmp                 word ptr [esi], ax

        $sequence_11 = { 8b0cba 03ce e8???????? 8bd0 e8???????? }
            // n = 5, score = 700
            //   8b0cba               | mov                 ecx, dword ptr [edx + edi*4]
            //   03ce                 | add                 ecx, esi
            //   e8????????           |                     
            //   8bd0                 | mov                 edx, eax
            //   e8????????           |                     

        $sequence_12 = { 8bfa 85c9 7436 85ff }
            // n = 4, score = 700
            //   8bfa                 | mov                 edi, edx
            //   85c9                 | test                ecx, ecx
            //   7436                 | je                  0x38
            //   85ff                 | test                edi, edi

        $sequence_13 = { 53 56 8b35???????? b84d5a0000 }
            // n = 4, score = 700
            //   53                   | push                ebx
            //   56                   | push                esi
            //   8b35????????         |                     
            //   b84d5a0000           | mov                 eax, 0x5a4d

        $sequence_14 = { 3bc7 72d5 5b 5f 8bc6 }
            // n = 5, score = 700
            //   3bc7                 | cmp                 eax, edi
            //   72d5                 | jb                  0xffffffd7
            //   5b                   | pop                 ebx
            //   5f                   | pop                 edi
            //   8bc6                 | mov                 eax, esi

        $sequence_15 = { 0fabd0 83fa20 6a08 0f43c8 33c1 }
            // n = 5, score = 700
            //   0fabd0               | bts                 eax, edx
            //   83fa20               | cmp                 edx, 0x20
            //   6a08                 | push                8
            //   0f43c8               | cmovae              ecx, eax
            //   33c1                 | xor                 eax, ecx

        $sequence_16 = { c60100 8bc6 5e c3 }
            // n = 4, score = 700
            //   c60100               | mov                 byte ptr [ecx], 0
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   c3                   | ret                 

        $sequence_17 = { 0fb6d1 03c2 0fb6c0 8945f8 }
            // n = 4, score = 600
            //   0fb6d1               | movzx               edx, cl
            //   03c2                 | add                 eax, edx
            //   0fb6c0               | movzx               eax, al
            //   8945f8               | mov                 dword ptr [ebp - 8], eax

        $sequence_18 = { 40 3d00010000 72f1 8bf2 }
            // n = 4, score = 600
            //   40                   | inc                 eax
            //   3d00010000           | cmp                 eax, 0x100
            //   72f1                 | jb                  0xfffffff3
            //   8bf2                 | mov                 esi, edx

        $sequence_19 = { 3d00010000 72f1 8b35???????? 8bf9 }
            // n = 4, score = 600
            //   3d00010000           | cmp                 eax, 0x100
            //   72f1                 | jb                  0xfffffff3
            //   8b35????????         |                     
            //   8bf9                 | mov                 edi, ecx

        $sequence_20 = { 0345f8 03c8 0fb6c9 894df8 }
            // n = 4, score = 600
            //   0345f8               | add                 eax, dword ptr [ebp - 8]
            //   03c8                 | add                 ecx, eax
            //   0fb6c9               | movzx               ecx, cl
            //   894df8               | mov                 dword ptr [ebp - 8], ecx

        $sequence_21 = { 81f900010000 72f0 8bf0 33d2 }
            // n = 4, score = 600
            //   81f900010000         | cmp                 ecx, 0x100
            //   72f0                 | jb                  0xfffffff2
            //   8bf0                 | mov                 esi, eax
            //   33d2                 | xor                 edx, edx

        $sequence_22 = { 0345f8 03c8 0fb6c1 8945f8 }
            // n = 4, score = 600
            //   0345f8               | add                 eax, dword ptr [ebp - 8]
            //   03c8                 | add                 ecx, eax
            //   0fb6c1               | movzx               eax, cl
            //   8945f8               | mov                 dword ptr [ebp - 8], eax

        $sequence_23 = { 8b01 0d20202020 3d6e74646c 750f }
            // n = 4, score = 400
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   0d20202020           | or                  eax, 0x20202020
            //   3d6e74646c           | cmp                 eax, 0x6c64746e
            //   750f                 | jne                 0x11

        $sequence_24 = { 89d3 0fb633 8d4ed0 80f909 }
            // n = 4, score = 300
            //   89d3                 | mov                 ebx, edx
            //   0fb633               | movzx               esi, byte ptr [ebx]
            //   8d4ed0               | lea                 ecx, [esi - 0x30]
            //   80f909               | cmp                 cl, 9

        $sequence_25 = { a3???????? 8b45e0 890424 a1???????? }
            // n = 4, score = 300
            //   a3????????           |                     
            //   8b45e0               | mov                 eax, dword ptr [ebp - 0x20]
            //   890424               | mov                 dword ptr [esp], eax
            //   a1????????           |                     

        $sequence_26 = { 8d45b4 890424 e8???????? 85c0 7513 }
            // n = 5, score = 300
            //   8d45b4               | lea                 eax, [ebp - 0x4c]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7513                 | jne                 0x15

        $sequence_27 = { a1???????? 8b0d???????? f725???????? 0faf0d???????? 01ca 0facd018 8945f4 }
            // n = 7, score = 300
            //   a1????????           |                     
            //   8b0d????????         |                     
            //   f725????????         |                     
            //   0faf0d????????       |                     
            //   01ca                 | add                 edx, ecx
            //   0facd018             | shrd                eax, edx, 0x18
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax

        $sequence_28 = { 8d4590 8944240c 31c0 c744240800000200 89442404 8b45e4 890424 }
            // n = 7, score = 300
            //   8d4590               | lea                 eax, [ebp - 0x70]
            //   8944240c             | mov                 dword ptr [esp + 0xc], eax
            //   31c0                 | xor                 eax, eax
            //   c744240800000200     | mov                 dword ptr [esp + 8], 0x20000
            //   89442404             | mov                 dword ptr [esp + 4], eax
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   890424               | mov                 dword ptr [esp], eax

        $sequence_29 = { b90b000000 89e5 57 53 8d7ded 8d5ded }
            // n = 6, score = 300
            //   b90b000000           | mov                 ecx, 0xb
            //   89e5                 | mov                 ebp, esp
            //   57                   | push                edi
            //   53                   | push                ebx
            //   8d7ded               | lea                 edi, [ebp - 0x13]
            //   8d5ded               | lea                 ebx, [ebp - 0x13]

        $sequence_30 = { 898264010000 891c24 e8???????? 8b15???????? }
            // n = 4, score = 300
            //   898264010000         | mov                 dword ptr [edx + 0x164], eax
            //   891c24               | mov                 dword ptr [esp], ebx
            //   e8????????           |                     
            //   8b15????????         |                     

    condition:
        7 of them and filesize < 1717248
}
Download all Yara Rules