{
  "family": "pikachu",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nThe Pikachu Worm (often detected as W32/Pikachu.worm) is a classic, early-2000s mass-mailing computer worm designed to appeal to children. Masquerading as a harmless, animated greeting card featuring the popular Pokémon character, its actual payload was highly destructive, attempting to completely delete core Windows operating system directories upon execution.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPikachu spread almost exclusively via email. It arrived in the victim's inbox with the subject line \"Pikachu Pokemon\" and a body text claiming \"Pikachu is your friend.\" The attached malicious executable was typically named `pikachuPokemon.exe`.\n\nUpon execution, the worm operated in two distinct phases:\n<ul>\n<li><strong>Propagation (Mass Mailing):</strong> Like many worms of its era (e.g., ILOVEYOU), Pikachu immediately accessed the victim's Microsoft Outlook Address Book. It then utilized Outlook's COM interface to automatically email a copy of itself to every contact in the address book, ensuring rapid, exponential spread across networks.</li>\n<li><strong>Destructive Payload:</strong> The worm's secondary function was system vandalism. It modified the `autoexec.bat` file (a critical startup script in older Windows versions like 95, 98, and ME). It added the commands `del C:\\WINDOWS\\*.* /y` and `del C:\\WINDOWS\\SYSTEM\\*.* /y`, which would attempt to delete the entire Windows directory upon the next system reboot.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the Pikachu worm is entirely obsolete and unable to function on modern Windows operating systems (due to changes in architecture and the deprecation of `autoexec.bat`), it is historically significant. At the time of its release, it caused widespread panic, particularly in educational institutions, due to its child-friendly disguise and destructive payload.\n\n<h3>Historical Remediation</h3>\n<ul>\n<li><strong>Payload Interception:</strong> Interestingly, the worm contained a flaw. It often prompted the user with a standard Windows confirmation dialog box (\"Are you sure you want to delete these files?\") before executing the destructive `del` commands, allowing alert users to cancel the payload.</li>\n<li><strong>Registry and File Cleanup:</strong> Remediation involved booting into Safe Mode, deleting the malicious `pikachuPokemon.exe` file, and manually editing the `autoexec.bat` file to remove the destructive commands before rebooting normally.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "W32/Pikachu.worm",
    "Worm.Pikachu",
    "Pikachu.exe"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1485",
    "T1114.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:16:56Z",
  "type": "Worm / Vandalism",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}