{
  "family": "aim_downloader",
  "sample_count": 0,
  "category": "downloader",
  "description": "Aim Downloader (historically classified as Downloader.Win32.Aim or Trojan-Downloader.Aim) refers to a specialized family of malicious utility droppers first documented in 2004. Engineered as a stealthy secondary stage conduit, its primary operational objective was fetching and executing secondary payloads from remote HTTP or FTP servers without user intervention. The malware achieved widespread underground notoriety due to deliberate nomenclature confusion: it routinely disguised its process image as 'aim.exe', the executable name belonging to the wildly popular AOL Instant Messenger client of that era. By hijacking this trusted binary identity, Aim Downloader blended seamlessly into Task Manager process listings, deceiving casual users and basic endpoint monitoring tools. Upon initial execution, Aim Downloader verified outbound internet connectivity via HTTP GET requests, retrieved encrypted binary blobs or obfuscated batch scripts, decrypted them directly in memory, and registered persistence via Windows Run keys before quietly terminating.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Downloader.Aim",
    "Trojan.Win32.AimDownloader",
    "Aim.exe Trojan"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Aim Downloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Aim Downloader is a vintage trojan dropper from 2004 designed to quietly download and deploy secondary malware payloads onto infected hosts."
      }
    },
    {
      "@type": "Question",
      "name": "Why did Aim Downloader use the name 'aim.exe'?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It masqueraded as AOL Instant Messenger (aim.exe), a ubiquitous communication client at the time, to evade visual detection."
      }
    },
    {
      "@type": "Question",
      "name": "What types of payloads did Aim Downloader fetch?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It fetched backdoor RATs, keystroke loggers, spam bots, and early banking surveillance trojans from remote C2 servers."
      }
    },
    {
      "@type": "Question",
      "name": "How did Aim Downloader establish persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It wrote autorun values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to copied binaries in the System32 folder."
      }
    },
    {
      "@type": "Question",
      "name": "How is Aim Downloader identified today?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Modern EDR and AV engines flag any standalone legacy aim.exe process exhibiting network drop behavior via static and behavioral heuristics."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1036.005",
    "T1055",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1036.005",
      "name": "Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Block outbound HTTP and FTP connections to suspicious dynamic DNS hosts and untrusted download endpoints.",
    "Kill unauthorized processes mimicking aim.exe running outside standard Program Files directory structures.",
    "Inspect system directories (e.g., C:\\Windows\\System32 and %TEMP%) for downloaded secondary stage PE executables.",
    "Verify cryptographic signatures of active system communication processes."
  ],
  "what_to_avoid": [
    "Do not presume an aim.exe binary is benign simply because legacy instant messaging clients were historically present.",
    "Avoid system rebooting before isolating the host to prevent automatic execution of downloaded second-stage binaries."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Malware Museum",
      "url": "https://www.malware.museum/families/"
    },
    {
      "name": "F-Secure",
      "url": "https://www.f-secure.com/"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "command_and_control"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "high",
  "first_seen": 2004,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "aim_trojan_downloader_engine"
    ],
    "variants": [
      "downloader.aim",
      "aim_trojan",
      "aim.exe"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2004-0363",
    "CVE-2004-1308"
  ],
  "iocs": {
    "file_hashes": [
      "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f",
      "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a"
    ],
    "delivery": [
      "Instant messaging social engineering messages distributing disguised aim.exe attachments",
      "Deceptive AOL Instant Messenger skin packs and theme installers"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AIMClientService",
      "Dropped executable masquerading in C:\\Windows\\System32\\aim.exe"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}