{
  "family": "pikabot",
  "sample_count": 850,
  "category": "loader",
  "description": "Pikabot is a highly evasive malware loader that emerged in early 2023. Sharing significant code similarities and distribution tactics with the notorious Qakbot botnet, it is widely utilized by initial access brokers to deploy secondary payloads, such as Cobalt Strike or ransomware.<br><br><b>What is Pikabot?</b><br>Pikabot consists of two primary components: a highly obfuscated injector and a core module. The malware employs advanced anti-analysis techniques, including API hashing, string encryption, and checking for debugging environments, making it incredibly difficult for automated sandboxes to analyze.<br><br><b>Infection Vectors & Threat Hunting</b><br>Distribution usually begins with malspam campaigns (often using hijacked email threads) delivering malicious ZIP archives containing JavaScript or IMG files. Once executed, Pikabot typically injects its payload into legitimate Windows processes like <code>WerFault.exe</code> (Windows Error Reporting). Threat hunters should look for abnormal child processes spawned by email clients or web browsers, and monitor for process hollowing techniques.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "pika_bot"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "Is Pikabot related to Qakbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "While not a direct clone, Pikabot uses similar distribution methods, internal structures, and target audiences, making it a spiritual successor to Qakbot."
      }
    }
  ],
  "faq_count": 1,
  "mitre_attack": [
    "T1566.001",
    "T1055.012",
    "T1140",
    "T1106"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-31",
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Hollowing",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the host to prevent Pikabot from downloading secondary ransomware payloads.",
    "Analyze memory dumps to extract the unencrypted Pikabot core module."
  ],
  "what_to_avoid": []
}