Deep dive into the Pikabot cyber threat

Pikabot is a recently discovered malware trojan and​ with the June update to Sophos NDR, we have added an additional machine learning model to detect the encrypted traffic pattern of suspect Pikabot communication. This detection capability has already been deployed to the Sophos NDR sensors, and no additional updates are required.

How Pikabot works

As a malware trojan, Pikabot is modular, composed of two main components: a loader and a core module. The core module executes the majority of the malware’s functions, while the loader assists in carrying out these malicious activities.​¹​.²​.

Pikabot operates as a backdoor, enabling unauthorized remote access to compromised systems. It receives commands from a command-and-control (C2) server, which can range from injecting arbitrary shellcode, DLLs, or executable files, to distributing other malicious tools such as Cobalt Strike. This suggests that Pikabot could be a potent player in multi-staged attacks.

The commands it can execute are diverse, including running shell commands, fetching and running EXE or DLL files, sending additional system information, altering the C2 check-in interval, and even a “destroy” command which is currently not implemented.¹​.

Distribution

Early analysis led researchers to believe that Pikabot was distributed by the Qakbot trojan. However, further study revealed that Pikabot’s distribution methods mirror those of Qakbot. The exact distribution methods remain somewhat of a mystery, but clear parallels with known Qakbot campaigns have been identified.​¹​.

Pikabot’s modus operandi

Pikabot’s modular structure allows it to carry out various malicious activities. Although the loader component has limited functionality, the core module is where the real action happens. Pikabot deploys an injector to run anti-analysis tests before decrypting and injecting the core module payload. If any of these tests fail, Pikabot aborts its execution, making it difficult for researchers to analyze and understand its actions.

In terms of anti-analysis techniques, Pikabot checks for the presence of debuggers, breakpoints, and system information. It uses public tools like ADVobfuscator for string obfuscation and has numerous methods to detect sandbox environments, debugging, and other analysis attempts.

The core module payload is cleverly encrypted and stored in PNG images. These images are decrypted using a hardcoded 32-byte key, and the decrypted data is further processed using AES (CBC mode). The payload is then injected into a specified process like WerFault, with Pikabot setting certain flags to protect the injected process from non-signed Microsoft binaries.²​.

Interesting findings

One of the intriguing features of Pikabot is its self-termination if the system’s language is Georgian, Kazakh, Uzbek, or Tajik. This suggests that the authors may be deliberately avoiding systems in specific geographic regions. Furthermore, Pikabot appears to be in the early stages of development as suggested by its version number (0.1.7) found in its initial communication with the C2 server.²​.

There are also striking similarities between Pikabot and another malware family, Matanbuchus. Both are written in C/C++, utilize a loader/core component split, employ JSON+Base64+crypto for traffic, and extensively use hardcoded strings. These similarities hint at a potential connection between the two malware families.​¹​.

Pikabot C2 infrastructure

With the June 2023 update to Sophos NDR, we added a CNN model to detect Pikabot and have already discovered a number of new C2 servers:

NOTE: The VirusTotal information for Sophos detections is delayed