{
  "family": "centrumdownloader",
  "sample_count": 38,
  "category": "trojan_downloader",
  "description": "Centrumdownloader (cataloged across security vendors and threat intelligence databases under signatures including TrojanDownloader:Win32/Centrumdownloader, Trojan:Win32/CentrumDownloader, and Dropper.Centrum) is a persistent Windows trojan downloader and stager active since 2017. Operating as an initial access broker tool, Centrumdownloader infiltrates endpoints primarily through deceptive freeware installers, weaponized torrent packages, and malicious email links. Upon execution, the malware profiles the host environment to detect sandboxes, establishes startup persistence via Windows Registry Run keys, and drops randomized staging executables into user temporary directories. Centrumdownloader initiates encrypted HTTP communications with remote C2 servers to download secondary high-severity payloads such as banking trojans, ransomware, and information stealers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Centrumdownloader",
    "Trojan:Win32/CentrumDownloader",
    "Dropper.Centrum",
    "Win32/Centrumdownloader",
    "TrojanDownloader:Win32/Centrumdownloader.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Centrumdownloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Centrumdownloader is a Windows trojan downloader designed to fetch and execute secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Centrumdownloader infect endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly distributed through deceptive software downloads, cracked application packages, and malicious emails."
      }
    },
    {
      "@type": "Question",
      "name": "Where does Centrumdownloader drop its execution artifacts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It unpacks randomized staging binaries and configuration scripts into user %AppData% and %Temp% directories."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically delivered by Centrumdownloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It delivers secondary payloads including credential stealers, banking trojans, and crypto-ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams remediate Centrumdownloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan, clean the %Temp% directory, and remove unauthorized Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1071.001",
    "T1082",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Software Cracks & Keygens",
    "Malicious Phishing Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "Host Environment Profiling",
    "Encrypted C2 Telemetry Beaconing",
    "Temporary Directory File Dropping",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded system telemetry to C2 servers",
      "Outbound TLS connections fetching secondary executable stages"
    ],
    "evasion_techniques": [
      "Execution from volatile temporary user directories (%Temp%)",
      "Dynamic API resolution to evade static import table detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "57291dc8f781bb49f8b15df726489312bcf8194a",
      "9385920a19e48b3b42f2b3e449a57291dc8f781b"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CentrumService"
    ],
    "file_paths": [
      "%Temp%\\centrum_loader.exe",
      "%AppData%\\Centrum\\client.bin"
    ]
  },
  "defensive_measures": [
    "Block executable execution from user temp paths (%Temp%)",
    "Deploy endpoint detection and response (EDR) to monitor unauthorized child process spawning",
    "Audit Windows Registry Run keys regularly for unknown persistence entries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Centrumdownloader",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Centrumdownloader"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Centrumdownloader.A",
      "TrojanDownloader:Win32/Centrumdownloader!rfn"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Threat Staging",
  "sample_hashes": []
}