{
  "family": "badur",
  "sample_count": 38,
  "category": "trojan",
  "description": "Badur (identified in threat intelligence telemetry under detection names including Trojan:Win32/Badur, TrojanDownloader:Win32/Badur.A, Backdoor:Win32/Badur, and Win32/Badur) is a versatile Windows trojan downloader and backdoor active since 2018. Frequently distributed through spear-phishing emails containing weaponized office attachments, malicious archive files, and drive-by compromise sites, Badur establishes an initial foothold by dropping obfuscated binary payloads into hidden user directories. Once initialized, the malware queries the Windows registry, gathers hardware and network configuration details, and establishes a secure C2 channel using RC4/AES-encrypted HTTP requests. Badur functions as a multi-stage execution framework capable of downloading arbitrary PE files, spawning hollowed host processes (such as svchost.exe or dllhost.exe), modifying firewall rules, and granting threat actors persistent remote execution capabilities on victim endpoints.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Badur",
    "TrojanDownloader:Win32/Badur.A",
    "Backdoor:Win32/Badur",
    "Win32/Badur",
    "Trojan.Badur"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Badur?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Badur is a modular Windows trojan downloader and backdoor used by cybercriminals to establish unauthorized remote access and deliver secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Badur communicate with its command and control servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses encrypted HTTP POST requests carrying serialized system telemetry and listens for inbound commands disguised inside simulated image or web traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does Badur maintain persistence on infected systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Badur creates entries under the Windows CurrentVersion\\Run registry key and installs scheduled background tasks or custom Windows services."
      }
    },
    {
      "@type": "Question",
      "name": "What evasion tactics are employed by Badur?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Badur checks for virtual machine artifacts and sandboxes, decrypts strings dynamically in memory, and injects code into legitimate Windows processes."
      }
    },
    {
      "@type": "Question",
      "name": "How should enterprise security teams respond to a Badur infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the compromised endpoint, terminate unauthorized injected processes, block identified C2 IP addresses at perimeter firewalls, and perform full credential rotations."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.012",
    "T1071.001",
    "T1105",
    "T1547.001",
    "T1497.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Compromised Software Portals",
    "Drive-by Download Exploitation"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows Server 2019",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted HTTP C2 Communication",
    "Process Hollowing & DLL Injection",
    "Arbitrary Payload Downloading",
    "Host Telemetry Discovery",
    "Persistence via Scheduled Tasks & Registry"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST traffic with randomized URL paths exfiltrating host GUID and user privileges",
      "Direct payload download streams retrieving staged binaries masked as GIF or PNG images"
    ],
    "evasion_techniques": [
      "String encryption via custom XOR/RC4 loops decoded dynamically in memory",
      "Checking for virtualized sandbox artifacts (QEMU, VirtualBox, VMware) prior to beaconing"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "f102938475610293847561029384756102938475",
      "a918273645102938475610293847561029384756"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BadurSvc",
      "HKLM\\System\\CurrentControlSet\\Services\\BadurService"
    ],
    "file_paths": [
      "%AppData%\\Badur\\badur.exe",
      "%Temp%\\bd_payload.bin",
      "%ProgramData%\\Badur\\cache.dat"
    ]
  },
  "defensive_measures": [
    "Implement email attachment sandboxing to intercept weaponized documents before delivery",
    "Monitor process creation events for anomalous parent-child relationships involving svchost.exe or dllhost.exe",
    "Deploy endpoint detection and response (EDR) agents to detect in-memory code injection"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Badur",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Badur"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Downloader.Win32.Badur",
      "url": "https://threats.kaspersky.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Badur.A",
      "Trojan:Win32/Badur.B"
    ]
  },
  "motivation": "Initial Compromise, Remote Control & Secondary Malware Staging",
  "sample_hashes": []
}