{
  "family": "amiboide",
  "sample_count": 0,
  "category": "backdoor",
  "description": "Amiboide is a historical malware family that primarily operated as a trojan horse, targeting Windows operating systems. It was often distributed through malicious email attachments or compromised software downloads. Once executed on a target machine, Amiboide established persistence by modifying system registry keys and installing hidden components deep within the operating system. The malware was designed to open a backdoor, granting remote attackers unauthorized access to the infected system. This allowed for various malicious activities, including data theft, keylogging, and the potential deployment of secondary payloads. Although its prevalence has waned in recent years due to improved security software and operating system defenses, Amiboide remains a notable example of early backdoor trojans and highlights the importance of robust endpoint protection and user awareness regarding suspicious files.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Amiboide",
    "Trojan.Amiboide"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Amiboide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Amiboide is a trojan horse malware designed to open a backdoor on infected Windows systems, allowing unauthorized remote access."
      }
    },
    {
      "@type": "Question",
      "name": "How does Amiboide infect systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It typically infects systems through malicious email attachments or compromised software downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What are the primary capabilities of Amiboide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its main capability is providing unauthorized remote access, which can lead to data theft, keylogging, and further malware deployment."
      }
    },
    {
      "@type": "Question",
      "name": "How does Amiboide maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It maintains persistence by modifying Windows registry keys and hiding its components within the system."
      }
    },
    {
      "@type": "Question",
      "name": "Is Amiboide still a major threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "While largely considered a legacy threat, it serves as a foundational example of backdoor trojans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059",
    "T1112",
    "T1056",
    "T1055"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Amiboide binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Amiboide installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Malware Museum",
      "url": "https://www.malware.museum/families/"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "amiboide_backdoor_framework"
    ],
    "variants": [
      "amiboide.gen",
      "trojan.amiboide"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2003-0352",
    "CVE-2003-0533"
  ],
  "iocs": {
    "file_hashes": [
      "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b",
      "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c"
    ],
    "delivery": [
      "Malicious email attachments disguised as software utilities and crack tools",
      "Network worm propagation targeting RPC DCOM vulnerability (CVE-2003-0352)"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AmiboideBackdoor",
      "Windows System Service registered under %SystemRoot%\\System32\\amiboide.exe"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}