{
  "family": "aenjaris",
  "sample_count": 22,
  "category": "trojan",
  "description": "Aenjaris (classified in antimalware research telemetry under designations including Trojan:Win32/Aenjaris, Trojan:Win32/Aenjaris.A, and Win32/Aenjaris) is a stealthy Windows-based trojan designed to execute unauthorized remote instructions, collect system telemetry, and compromise endpoint integrity. Distributed through weaponized spearphishing email attachments, exploit kits, and malicious software cracks, Aenjaris deploys an obfuscated initial stager that checks for virtualization indicators and debugging environments. Upon successful host profiling, it writes persistence values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and injects its core DLL into legitimate Windows processes such as explorer.exe or svchost.exe using process hollow or thread hijacking techniques. Aenjaris establishes encrypted HTTP/HTTPS command-and-control channels, allowing operators to exfiltrate cached browser credentials, execute arbitrary command shell directives, download secondary malware payloads, and modify system settings.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Aenjaris",
    "Trojan:Win32/Aenjaris.A",
    "Trojan:Win32/Aenjaris.B",
    "Win32/Aenjaris",
    "Backdoor:Win32/Aenjaris"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Aenjaris?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Aenjaris is a stealthy Windows trojan that executes remote commands, injects into legitimate system processes, and exfiltrates system data."
      }
    },
    {
      "@type": "Question",
      "name": "How does Aenjaris evade endpoint detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtual machine sandboxes and injects its malicious payloads into legitimate Windows processes like explorer.exe and svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How does Aenjaris establish persistence on victim machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates auto-start registry run values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to launch at user logon."
      }
    },
    {
      "@type": "Question",
      "name": "What data is gathered by Aenjaris upon compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It gathers computer hostnames, OS version details, network configurations, and cached credentials from web browsers."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended containment steps for Aenjaris?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected machine from the corporate network, terminate injected processes, remove registry run entries, and reset affected user credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Aenjaris",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Aenjaris"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Aenjaris",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.aenjaris"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Aenjaris",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Aenjaris"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Isolate the affected workstation from the enterprise network to prevent lateral movement.",
    "Capture volatile physical memory to inspect injected threads inside explorer.exe or svchost.exe.",
    "Kill unauthorized processes and delete malicious binaries located in %TEMP% and %APPDATA%.",
    "Remove Run registry entries pointing to the trojan loader under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block identified C2 IP addresses and domain names across egress boundary firewalls and DNS filters."
  ],
  "what_to_avoid": [
    "Do not allow the infected host to communicate outbound to internet endpoints during forensic triage.",
    "Do not rely solely on standard file deletion without auditing injected memory spaces."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Financial Services",
    "Technology"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Operators"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Data Exfiltration & Secondary Payload Execution",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}