{
  "family": "coolvibes",
  "sample_count": 16,
  "category": "trojan",
  "description": "Coolvibes is a legacy Remote Access Trojan (RAT) that gained notoriety in the late 1990s and early 2000s for enabling unauthorized control over Windows operating systems. Utilizing a standard client-server architecture, the malware secretly installs a server module on the victims PC, which binds to a specific port and listens for incoming commands from the attackers client interface. Coolvibes is particularly recognized for its extensive and somewhat juvenile feature set, which includes serious capabilities like file system browsing, registry editing, and password theft, alongside harassment features such as opening and closing the CD-ROM tray, hiding the Windows taskbar, and displaying persistent, unclosable message boxes. Distributed frequently via P2P file-sharing networks and bundled with cracked software or fake game generators, Coolvibes heavily relies on user deception for execution. Although easily detected and removed by modern endpoint protection, it remains a classic example of early script-kiddie malware tools.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Cool Vibes RAT",
    "Win32.Coolvibes"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Coolvibes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is a legacy Windows Remote Access Trojan from the late 90s and early 2000s."
      }
    },
    {
      "@type": "Question",
      "name": "What features does Coolvibes have?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It includes file theft, keystroke logging, and harassment features like opening the CD-ROM."
      }
    },
    {
      "@type": "Question",
      "name": "How was Coolvibes distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Usually disguised as legitimate files on P2P networks like Limewire or Kazaa."
      }
    },
    {
      "@type": "Question",
      "name": "Does it operate quietly?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Not always; many attackers used its prank features to actively harass the victim, revealing the infection."
      }
    },
    {
      "@type": "Question",
      "name": "Is it a threat to modern Windows 11 systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, modern security architectures and Windows Defender easily intercept and quarantine Coolvibes."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1071",
    "T1056.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1071",
      "name": "Application Layer Protocol (Stratum Protocol to Mining Pools)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Coolvibes binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Coolvibes installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Kaspersky Virus Encyclopedia - Trojan.Win32.Coolvibes",
      "url": "https://securelist.com"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2012-0158",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0158"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "lineage": {
    "derived_from": [
      "visual_basic_remote_access_trojan"
    ],
    "variants": [
      "coolvibes_v1.0",
      "trojan.coolvibes"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2012-0158",
    "CVE-2015-1641"
  ],
  "iocs": {
    "file_hashes": [
      "d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4",
      "e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5"
    ],
    "delivery": [
      "P2P file sharing distributions masked as media players and software cracks",
      "Phishing email attachments containing VB-compiled dropper stagers"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CoolvibesClient",
      "Windows Startup folder executable link '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\coolvibes.exe'"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}