{
  "family": "bloored",
  "sample_count": 74,
  "category": "trojan",
  "description": "Bloored (cataloged in antivirus vendor databases under detections including Trojan:Win32/Bloored, Trojan.Bloored, and Trojan.Win32.Bloored) is a generic Windows trojan and initial access dropper active since 2014. Distributed predominantly through deceptive software bundles, video codec installers, and cracked software activators, Bloored employs multi-stage execution routines to evade static endpoint heuristics. Upon installation, the malware unpacks encrypted payloads in memory, injects code into running system processes, and disables local Windows security controls and notification services. Bloored beacons host telemetry (including computer name, operating system version, and installed antivirus software) to remote attacker-controlled command-and-control servers, subsequently downloading and staging secondary threats such as adware injectors, ransomware precursors, and cryptocurrency miners. Persistence is maintained through registry modifications under Windows CurrentVersion\\Run and hidden startup folder entries.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Bloored",
    "Trojan.Bloored",
    "Trojan.Win32.Bloored"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Bloored?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bloored is a Windows trojan dropper that disables security controls and downloads secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bloored infect user workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through deceptive bundled software installers, fake media codecs, and cracked software activators."
      }
    },
    {
      "@type": "Question",
      "name": "What defense evasion techniques are used by Bloored?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects payloads into legitimate system processes and attempts to disable security notification services."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically dropped by Bloored?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently drops cryptominers, adware click-fraud modules, and initial access backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How do administrators remove Bloored from an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminate suspicious processes, remove startup registry entries, and run an offline antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1055",
    "T1547.001",
    "T1562.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Bloored frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Secondary Payload Distribution & Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Fake Video Codecs & Media Players",
    "Software Cracks & Keygens"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Process Memory Injection",
    "Disabling Security Defenses",
    "Secondary Malware Downloading",
    "Host Telemetry Gathering",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound HTTP POST beacons transmitting host system fingerprints",
      "HTTP payload download requests to dynamic file-hosting domains"
    ],
    "evasion_techniques": [
      "Encrypted payload sections unpacked dynamically in RAM",
      "Process injection into trusted system processes"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BlooredService",
      "Startup folder executable shortcuts"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Endpoint defense impairment, unauthorized secondary software installation, system instability"
  },
  "lineage": {
    "derived_from": [
      "Win32 Multi-Stage Trojan Loaders"
    ],
    "variants": [
      "Bloored.A",
      "Bloored.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0",
      "f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1"
    ],
    "delivery": [
      "codec_setup.exe",
      "bloored_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BlooredUpdate",
      "%AppData%\\Bloored\\bloored_daemon.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Bloored",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bloored"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Bloored",
      "url": "https://www.trendmicro.com"
    }
  ]
}