Pikachu

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Propagation (Mass Mailing): Like many worms of its era (e.g., ILOVEYOU), Pikachu immediately accessed the victim's Microsoft Outlook Address Book. It then utilized Outlook's COM interface to automatically email a copy of itself to every contact in the address book, ensuring rapid, exponential spread across networks.
• Destructive Payload: The worm's secondary function was system vandalism. It modified the `autoexec.bat` file (a critical startup script in older Windows versions like 95, 98, and ME). It added the commands `del C:\WINDOWS\*.* /y` and `del C:\WINDOWS\SYSTEM\*.* /y`, which would attempt to delete the entire Windows directory upon the next system reboot.

Threat Assessment

Historical Remediation

• Payload Interception: Interestingly, the worm contained a flaw. It often prompted the user with a standard Windows confirmation dialog box ("Are you sure you want to delete these files?") before executing the destructive `del` commands, allowing alert users to cancel the payload.
• Registry and File Cleanup: Remediation involved booting into Safe Mode, deleting the malicious `pikachuPokemon.exe` file, and manually editing the `autoexec.bat` file to remove the destructive commands before rebooting normally.

Known aliases

Threat reports may refer to this family under multiple names:

• W32/Pikachu.worm
• Worm.Pikachu
• Pikachu.exe

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1566.001 T1485 T1114.003

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PIKACHU {
    meta:
        description = "Detects Pikachu (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "pikachu" ascii wide nocase
        $s2 = "w32/pikachu.worm" ascii wide nocase
        $s3 = "worm.pikachu" ascii wide nocase
        $s4 = "pikachu.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Pikachu Activity
id: 9ce44f88a25272b6d9cbb430ebbcfcf1
status: experimental
description: Detects generic indicators of the pikachu malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*pikachu*"
            - "*w32/pikachu.worm*"
            - "*worm.pikachu*"
            - "*pikachu.exe*"
    condition: selection
level: medium

References & External Analysis

• Search "pikachu" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Softomate
• Joosoft
• Scramupx
• Appscience
• Gorgon

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/pikachu.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.