Pikabot is a modular backdoor malware with a loader and core module that can execute a range of C2 commands, inject payloads into system processes, and even distribute tools like Cobalt Strike. Sophos NDR has added a machine learning model to detect Pikabot’s encrypted traffic patterns, deployed across sensors with no extra updates needed.
#Pikabot #Qakbot #Matanbuchus #CobaltStrike #SophosNDR
#Pikabot #Qakbot #Matanbuchus #CobaltStrike #SophosNDR
Keypoints
- Pikabot is modular, consisting of a loader and a core module; the core handles most malicious actions while the loader assists in deployment.
- The malware acts as a backdoor, receiving commands from a C2 server to inject shellcode, DLLs, or executables, and to distribute tools like Cobalt Strike.
-
-
MITRE Techniques
- [T1055] Process Injection – The core payload is injected into a specified process like WerFault (‘The payload is then injected into a specified process like WerFault’).
- [T1105] Ingress Tool Transfer – Pikabot deploys an injector/core flow that can fetch and run additional tools, including Cobalt Strike (‘distributing other malicious tools such as Cobalt Strike’).
- [T1071] Command and Control – It operates as a backdoor receiving commands from a C2 server (‘receives commands from a command-and-control (C2) server’).
- [T1027] Obfuscated/Compressed Files and Information – The core payload is encrypted, stored in PNG images, decrypted with a 32-byte key, and processed with AES-CBC (‘payload is cleverly encrypted and stored in PNG images… decrypted using a hardcoded 32-byte key, and the decrypted data is further processed using AES (CBC mode)’).
- [T1497.001] Virtualization/Sandbox Evasion – It performs anti-analysis checks (debuggers, breakpoints, sandbox) to hinder analysis (‘checks for the presence of debuggers, breakpoints, and system information… detect sandbox environments’).
Indicators of Compromise
- [IP Address] C2 endpoints – 192[.]9[.]135[.]73:1194, 185[.]87[.]148[.]132:1194, and 2 more addresses
- [IP Address] C2 endpoints – 45[.]154[.]24[.]57:2078, 45[.]85[.]235[.]39:2078, and 1 more address
- [JARM] TLS fingerprint – 21d19d00021d21d21c21d19d21d21dd188f9fdeea4d1b361be3a6ec494b2d2
- [JARM] TLS fingerprint – 21d19d00021d21d21c21d19d21d21dd188f9fdeea4d1b361be3a6ec494b2d2
Read more: https://news.sophos.com/en-us/2023/06/12/deep-dive-into-the-pikabot-cyber-threat/