Pikabot is a sophisticated, modular malware family that first emerged in early 2023 and has rapidly evolved into a major threat in the cybercrime landscape. It is primarily known as a loader and backdoor trojan, enabling attackers to deliver additional payloads—including ransomware, spyware, and remote access tools—while also providing extensive remote control capabilities over compromised systems. Pikabot has filled a gap left by the takedown of QakBot, with many of its tactics, techniques, and procedures (TTPs) closely mirroring those of QakBot and other loader malware like DarkGate and IcedID.

Technical Architecture and Functionality
• Pikabot consists of two main components: a loader and a core backdoor module.
• The loader is responsible for initial infection, unpacking, and injecting the core module into legitimate system processes using advanced code injection techniques.
• The core module handles command execution, payload delivery, system reconnaissance, data exfiltration, and interaction with the attacker’s command-and-control (C2) infrastructure.

Key Capabilities
• Arbitrary command execution via C2.
• Download and execution of additional payloads (malware, ransomware, Cobalt Strike beacons).
• Process injection into legitimate Windows binaries (e.g., ctfmon.exe) to evade detection.
• System and network reconnaissance to assist in lateral movement and privilege escalation.
• Collection and exfiltration of sensitive information (credentials, banking data, personal information).
• Persistence mechanisms and lateral movement across networks.

Evasion and Anti-Analysis Techniques
Pikabot employs an array of advanced evasion tactics to avoid detection and hinder analysis:
• Anti-VM and anti-debugging checks: Detects virtual environments and debugging tools, terminating itself if found.
• Language checks: Self-terminates if the system language matches those of CIS countries (e.g., Russian, Ukrainian, Belarusian), avoiding infection in those regions.
• Code obfuscation: Uses encrypted strings, junk code, and indirect system calls to complicate static and dynamic analysis.
• Delayed execution: Postpones malicious actions to outlast sandbox analysis windows.
• Dynamic configuration: Newer versions download configuration files from C2 servers rather than relying on hardcoded settings, increasing adaptability.