MITRE ATT&CKsoftware (malware)

S1145 Pikabot

Published 2024-07-12 Modified 2024-10-28 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2024-07-12

Description

Pikabot is a backdoor used for initial access and follow-on tool deployment active since early 2023. Pikabot is notable for extensive use of multiple encoding, encryption, and defense evasion mechanisms to evade defenses and avoid analysis. Pikabot has some overlaps with QakBot, but insufficient evidence exists to definitively link these two malware families. Pikabot is frequently used to deploy follow on tools such as Cobalt Strike or ransomware variants.

Related

Uses · MITRE ATT&CK (21)

  • T1027.011 Fileless Storage sub-technique
  • T1027.009 Embedded Payloads sub-technique
  • T1622 Debugger Evasion technique
  • T1620 Reflective Code Loading technique
  • T1480.001 Environmental Keying sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1571 Non-Standard Port technique
  • T1059.003 Windows Command Shell sub-technique
  • T1497.001 System Checks sub-technique
  • T1087.001 Local Account sub-technique
  • T1027.003 Steganography sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1055.002 Portable Executable Injection sub-technique
  • T1055.003 Thread Execution Hijacking sub-technique
  • T1482 Domain Trust Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1016 System Network Configuration Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1082 System Information Discovery technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (3)

  • G1037 TA577 group
  • C0036 Pikabot Distribution February 2024 campaign
  • C0037 Water Curupira Pikabot Distribution campaign

References