Awesome

Pikabot Deobfuscator

An IDA plugin to deobfuscate Pikabot's strings using RC4 and AES

Compatibility

The Pikabot plugin has been tested with IDA versions 8 and newer. The plugin can be executed by compiling the source code using IDA's SDK and/or copying the generated DLL into the IDA plugins folder. After a Pikabot sample is loaded, the user can decompile a function and right-click in the decompiled output and either choose to decrypt strings in the current function or in all of them.

For each decrypted string, the plugin sets a comment in the decompiled output.

Before

After

Example Pikabot Samples