{
  "family": "chisburg",
  "sample_count": 38,
  "category": "infostealer",
  "description": "Chisburg (cataloged across security vendors and threat intelligence databases under signatures including Trojan-PSW.Win32.Chisburg, PWS:Win32/Chisburg, and Trojan.Chisburg) is a persistent Windows password-stealing trojan (Trojan-PSW) and infostealer active since 2010. Designed to covertly exfiltrate credentials from compromised endpoints, Chisburg targets local application credential stores across web browsers, FTP clients (such as FileZilla), instant messaging platforms, and email clients. Delivered via spearphishing emails, cracked software packages, and infected removable USB drives, Chisburg establishes persistence through Windows Registry Run keys, extracts cached passwords and authentication tokens, and transmits the stolen credentials to remote attacker C2 servers via encrypted HTTP/SMTP channels.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-PSW.Win32.Chisburg",
    "PWS:Win32/Chisburg",
    "Trojan.Chisburg",
    "Win32/Chisburg",
    "Trojan-PSW:Win32/Chisburg.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-PSW.Win32.Chisburg?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chisburg is a Windows password-stealing trojan designed to harvest credentials from browsers, FTP, and email clients."
      }
    },
    {
      "@type": "Question",
      "name": "What software applications are targeted by Chisburg?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It specifically targets FileZilla FTP configs, web browser password databases, email profiles, and messaging tokens."
      }
    },
    {
      "@type": "Question",
      "name": "How does Chisburg exfiltrate harvested passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It packages credentials into encrypted text archives and sends them via HTTP POST beacons or direct SMTP messages."
      }
    },
    {
      "@type": "Question",
      "name": "Can Chisburg propagate through USB flash drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, variants have been observed copying themselves to removable USB drives with autorun.inf files."
      }
    },
    {
      "@type": "Question",
      "name": "How can affected users secure their systems and accounts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a Microsoft Defender Offline scan, reset all saved passwords from a clean device, and enable multi-factor authentication."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1555.004",
    "T1056.001",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2010,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Software Cracks & Keygens",
    "Infected Removable USB Drives"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "FTP Credential Extraction (FileZilla)",
    "Browser Password & Cookie Theft",
    "Email Client Account Harvesting",
    "Encrypted SMTP / HTTP Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C++ / Delphi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting zipped credential dumps to remote drop boxes",
      "Outbound SMTP connections on TCP port 25/587 sending email reports to attacker inboxes"
    ],
    "evasion_techniques": [
      "Packaging binaries using AutoIt or commercial cryptors",
      "Stealthy extraction of credential files without spawning suspicious external processes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "891bb49f8b15df726489312bcf8194ad92716492",
      "c3f8194ad9271649275819385920a19e48b3b42f"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ChisburgStealer"
    ],
    "file_paths": [
      "%AppData%\\Chisburg\\chisburg.exe",
      "%Temp%\\pws_dump.tmp"
    ]
  },
  "defensive_measures": [
    "Enforce multi-factor authentication (MFA) across all email, FTP, and cloud services",
    "Deploy endpoint detection rules for unauthorized file reads targeting FileZilla and browser credential stores",
    "Disable AutoRun/AutoPlay for removable storage media"
  ],
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Trojan-PSW.Win32.Chisburg",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-PSW.Win32.Chisburg/"
    },
    {
      "name": "Cisco Talos Threat Intelligence - Chisburg Stealer Analysis",
      "url": "https://talosintelligence.com/"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan-PSW.Win32.Chisburg.A",
      "PWS:Win32/Chisburg!rfn"
    ]
  },
  "motivation": "Financial Crime, Credential Harvesting & Account Takeover",
  "sample_hashes": []
}