Shinji Robert Arasawa, Joshua Aquino, Charles Steven Derion, Juhn Emmanuel Atanque, Francisrey Joshua Castillo, John Carlo Marquez, Henry Salcedo, John Rainier Navato, Arianne Dela Cruz, Raymart Yambot & Ian Kenefick. (2024, January 9). Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign. Retrieved July 17, 2024.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1059.003 Windows Command Shell |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe. |
| T1059.007 JavaScript |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives. |
| T1105 Ingress Tool Transfer |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory. |
| T1140 Deobfuscate/Decode Files or Information |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot. |
| T1204 User Execution |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution requires users to interact with malicious attachments in order to start Pikabot installation. |
| T1204.001 Malicious Link |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer. |
| T1204.002 Malicious File |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution delivered Pikabot installers as password-protected ZIP files containing heavily obfuscated JavaScript, or IMG files containing an LNK mimicking a Word document and a malicious DLL. |
| T1218.011 Rundll32 |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports `Crash` or `Limit` depending on the variant. |
| T1566.001 Spearphishing Attachment |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution attached password-protected ZIP archives to deliver Pikabot installers. |
| T1589.002 Email Addresses |
CampaignWater Curupira Pikabot Distribution | Water Curupira Pikabot Distribution utilizes thread spoofing of existing email threads in order to execute spear phishing operations. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
