{
  "family": "bang5mai",
  "sample_count": 36,
  "category": "backdoor",
  "description": "Bang5mai (identified across endpoint security databases and threat intelligence feeds under signatures including Trojan:Win32/Bang5mai, Backdoor:Win32/Bang5mai, and Trojan.Bang5mai) is a covert Windows backdoor and targeted initial access implant active since 2017. Typically deployed in spear-phishing campaigns delivering weaponized Office documents or embedded in trojanized developer toolkits, Bang5mai establishes persistent access through scheduled tasks and registry autostart keys. Upon installation, the malware collects detailed host metadata—including system architecture, domain memberships, user privileges, and running security processes—and communicates with external C2 servers over HTTPS. Bang5mai features a modular payload execution engine that allows remote operators to execute arbitrary command-line strings, manipulate host files and directories, inject secondary DLL payloads into legitimate Windows processes (such as svchost.exe), and stage lateral movement tools across corporate Active Directory environments.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Bang5mai",
    "Backdoor:Win32/Bang5mai",
    "Trojan.Bang5mai",
    "Win32/Bang5mai",
    "Trojan:Win32/Bang5mai.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Bang5mai?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bang5mai is a modular Windows backdoor that provides unauthorized remote access, executes commands, and stages lateral movement in enterprise networks."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bang5mai achieve persistence on Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates hidden scheduled tasks and writes entries to the Windows CurrentVersion\\Run registry key to ensure execution on system reboot."
      }
    },
    {
      "@type": "Question",
      "name": "What host information is gathered by Bang5mai?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It collects computer hostnames, active domain memberships, user privilege levels, network adapter configurations, and installed antivirus software."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bang5mai evade detection during command execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects payload worker threads into legitimate Windows system processes like svchost.exe and communicates over encrypted HTTPS channels."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended incident response actions for Bang5mai?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected endpoint from the network, terminate unauthorized injected processes, remove persistence tasks, and reset corporate domain credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055",
    "T1071.001",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-Phishing Emails with Weaponized Office Attachments",
    "Trojanized Developer Toolkits",
    "Compromised Software Dependencies"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows 7"
  ],
  "capabilities": [
    "Remote Interactive Command Shell",
    "Process Injection into svchost.exe",
    "Encrypted HTTPS C2 Beaconing",
    "Host Reconnaissance & Domain Enumeration",
    "Persistence via Scheduled Tasks & Registry"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Periodic HTTPS POST requests carrying RC4/AES-encrypted host telemetry blobs with randomized URL URI parameters",
      "Direct downloads of secondary stage binary payloads masquerading as temporary log files"
    ],
    "evasion_techniques": [
      "Dynamic API resolution via PEB hashing to evade static import table detection",
      "Checking for virtual machine artifacts and debugger presence prior to establishing network beacons"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0",
      "a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bang5maiSvc",
      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Bang5maiTask"
    ],
    "file_paths": [
      "%AppData%\\Bang5mai\\bang5mai.exe",
      "%Temp%\\b5m_stage.dll",
      "%ProgramData%\\Bang5mai\\config.dat"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection and response (EDR) rules to monitor for process hollowing and unauthorized thread injection into svchost.exe",
    "Inspect perimeter HTTPS connections for anomalous periodic beaconing to unclassified IP addresses",
    "Enforce strict email filtering to strip weaponized macro-enabled attachments before reaching user inboxes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Bang5mai",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bang5mai"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Bang5mai",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Bang5mai.A",
      "Backdoor:Win32/Bang5mai.B"
    ]
  },
  "motivation": "Targeted Intrusions, Unauthorized Remote Control & Lateral Movement",
  "sample_hashes": []
}