{
  "family": "acid_drop",
  "sample_count": 0,
  "category": "trojan",
  "description": "Acid Drop (also documented in historical archives as AcidDrop or Backdoor.AcidDrop) is a vintage remote access backdoor and Trojan horse originating in the late 1990s and early 2000s underground scene. Documented comprehensively within classic archival repositories like the Kobayashi and Mega Security Trojan databases, Acid Drop exemplified the early transition from rudimentary desktop prank kits to structured remote endpoint compromise tools. The malware deployed a client-server architecture where a lightweight server executable was dropped on victim machines via deceptive archive attachments or IRC file sharing. Once executed, Acid Drop installed itself into the system directory, created persistence hooks via Windows INI files and startup registry hives, and bound a listening socket to wait for incoming operator commands. Threat actors utilizing the Acid Drop client interface could remotely browse files, initiate arbitrary process execution, restart or shut down remote machines, and inspect basic networking state.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "AcidDrop",
    "Backdoor.AcidDrop",
    "Trojan.AcidDrop"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Acid Drop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Acid Drop is a vintage Trojan horse and backdoor tool from the late 1990s that enabled remote endpoint management and control."
      }
    },
    {
      "@type": "Question",
      "name": "How was Acid Drop delivered to targets?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was typically distributed via email attachments, file-sharing repositories, and IRC DCC chat transfers disguised as games or utilities."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities did the Acid Drop server provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allowed remote operators to browse file systems, execute arbitrary binaries, view system information, and trigger reboots."
      }
    },
    {
      "@type": "Question",
      "name": "How did Acid Drop achieve autostart persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appended startup keys to HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and legacy system.ini files."
      }
    },
    {
      "@type": "Question",
      "name": "How is Acid Drop remediated on legacy systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the workstation, terminate the running process, delete dropped executable files, and clean modified registry entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059",
    "T1112",
    "T1083",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Block incoming connection requests on unauthorized TCP listening ports configured by the trojan.",
    "Locate and delete rogue binaries residing in C:\\Windows and C:\\Windows\\System.",
    "Remove startup registry entries located under HKCU and HKLM Run keys.",
    "Review local network traffic logs to determine if unauthorized commands were transmitted across the segment."
  ],
  "what_to_avoid": [
    "Do not allow unmonitored inbound network ports on legacy Windows installations without perimeter firewall filtering.",
    "Avoid manual file deletion without verifying registry references to prevent broken startup errors."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Malware Museum",
      "url": "https://www.malware.museum/families/"
    },
    {
      "name": "Mega Security Archives",
      "url": "https://megasecurity.org/"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2002,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "acid_backdoor_family"
    ],
    "variants": [
      "aciddrop.gen",
      "trojan.aciddrop"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2001-0500",
    "CVE-2003-0352"
  ],
  "iocs": {
    "file_hashes": [
      "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b",
      "5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c"
    ],
    "delivery": [
      "Compromised software distribution archives and peer-to-peer file sharing networks",
      "Direct network compromise targeting unpatched RPC services (CVE-2003-0352)"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AcidDropServer",
      "Win.ini autorun string pointing to staged payload in C:\\Windows\\System\\"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}