{
  "family": "a_311_death",
  "sample_count": 0,
  "category": "banking_trojan",
  "description": "A-311 Death is a seminal Remote Administration Tool (RAT) and Trojan active during the early-to-mid 2000s threat landscape. Operating primarily as an invasive stealth backdoor, it afforded remote operators unconstrained interactive control over compromised Windows endpoints. Architecturally, A-311 Death evolved from basic client-server administrative sockets into an advanced credential-harvesting weapon, introducing form-grabbing routines targeting web browser sessions, Transaction Authentication Number (TAN) interception for banking fraud, and inline HTTP redirection mechanisms designed for banking phishing attacks. Multiple threat researchers correlate A-311 Death directly with the emergence of the notorious Haxdoor malware family, frequently identifying it as the foundational toolkit and builder from which Haxdoor variants branched. The trojan exhibited custom rootkit cloaking features to mask its process image and disk artifacts, and famously issued the greeting string 'A-311 Death welcome' across established C2 sessions upon client authentication. Distributed commercially across underground forums in Standard, Full, and Ultimate tiers, A-311 Death stood as one of the earliest commercial precursors to modern Malware-as-a-Service (MaaS) crime kits.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Haxdoor",
    "A-311",
    "Trojan.Haxdoor.A311"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is A-311 Death?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A-311 Death is a historical Remote Access Trojan and backdoor from the early 2000s designed for unauthorized remote administration and financial credential theft."
      }
    },
    {
      "@type": "Question",
      "name": "How did A-311 Death compromise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed via malicious attachments, cracked underground utilities, and web exploit droppers, installing stealth background listeners."
      }
    },
    {
      "@type": "Question",
      "name": "What is the relationship between A-311 Death and Haxdoor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A-311 Death served as an early build framework and core codebase precursor for the notorious Haxdoor banking trojan family."
      }
    },
    {
      "@type": "Question",
      "name": "What specific theft capabilities did A-311 Death possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It pioneered browser form-grabbing, banking TAN code interception, keystroke logging, and hidden rootkit process concealment."
      }
    },
    {
      "@type": "Question",
      "name": "How was A-311 Death monetized by its developers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was sold as a commercial malware toolkit across early hacker forums in Standard, Full, and Ultimate editions, pioneering Malware-as-a-Service."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059",
    "T1055",
    "T1056.001",
    "T1112",
    "T1569"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1569",
      "name": "System Services",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate compromised hosts from network segments to sever active command sockets and prevent exfiltration.",
    "Terminate spawned backdoor binaries and inspect hook DLLs injected into explorer.exe or browser processes.",
    "Scrub malicious registry autorun entries in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and system service registrations.",
    "Reset all financial, administrative, and domain credentials accessed from the impacted workstation."
  ],
  "what_to_avoid": [
    "Do not execute system recovery without memory triage, as rootkit components will evade basic file-system scanning.",
    "Do not access production banking or administrative portals until full operating system re-imaging is confirmed."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Malware Museum",
      "url": "https://www.malware.museum/families/"
    },
    {
      "name": "Securelist",
      "url": "https://securelist.com/"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "credential_access"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "high",
  "first_seen": 2005,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "haxdoor_banking_rootkit"
    ],
    "variants": [
      "haxdoor.a311",
      "a-311_death_trojan",
      "goldun"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2006-0003",
    "CVE-2006-1359"
  ],
  "iocs": {
    "file_hashes": [
      "2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f",
      "3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a"
    ],
    "delivery": [
      "Spear-phishing emails delivering weaponized Microsoft Office documents exploiting CVE-2006-0003",
      "Drive-by download landing pages utilizing Internet Explorer memory corruption exploits (CVE-2006-1359)"
    ],
    "persistence": [
      "System service registration installing kernel-mode rootkit drivers in %SystemRoot%\\System32\\drivers",
      "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}