{
  "family": "detrahere",
  "sample_count": 38,
  "category": "rootkit",
  "description": "Detrahere (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Detrahere, Trojan:Win64/Detrahere.S, and Rootkit.Detrahere) is an advanced Windows multi-component trojan and kernel rootkit active since 2018. Designed for deep system persistence and stealthy network traffic manipulation, Detrahere deploys malicious kernel-mode network filtering drivers (NetFilter). The rootkit hooks low-level Windows networking APIs (WFP / TDI) to inspect, redirect, and inject malicious content into outbound HTTP/HTTPS sessions while concealing its own command-and-control communications from task managers and endpoint security scanners. Furthermore, Detrahere provides operators with persistent backdoor capabilities to execute remote commands and deploy secondary payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Detrahere",
    "Trojan:Win64/Detrahere.S",
    "Rootkit.Detrahere",
    "Win32/Detrahere",
    "Trojan:Win32/Detrahere!rfn"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Detrahere?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Detrahere is an advanced Windows trojan and kernel rootkit that uses NetFilter drivers to manipulate network traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does Detrahere manipulate network traffic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deploys kernel-mode network filtering drivers to inspect and redirect network connections and conceal C2 traffic."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Detrahere difficult to remove?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it installs kernel-level drivers that lock files and resist standard Windows user-mode deletion."
      }
    },
    {
      "@type": "Question",
      "name": "How is Detrahere delivered to endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through trojanized utility software, cracked games, and secondary malware droppers."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders remediate a Detrahere infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan to unload and delete kernel drivers before the operating system boots."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1014",
    "T1055",
    "T1547.006",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Software Installers",
    "Secondary Malware Droppers",
    "Cracked Game Packages"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ],
  "capabilities": [
    "Kernel-Mode Driver Installation (NetFilter)",
    "Network Traffic Interception & Redirection",
    "Rootkit Process & Driver Concealment",
    "Remote Shell Command Execution",
    "Secondary Payload Ingestion"
  ],
  "technical_analysis": {
    "file_types": [
      "Kernel Mode Driver (.sys)",
      "Win32 PE Executable",
      "Win64 PE Executable"
    ],
    "network_signatures": [
      "Encrypted TCP / HTTP C2 communication hidden behind manipulated local filtering sockets",
      "DNS requests routing web sessions through malicious proxy addresses"
    ],
    "evasion_techniques": [
      "Abusing stolen or forged digital certificates to bypass driver signature enforcement",
      "Operating at kernel privilege (Ring 0) to disable user-mode security hooks"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "cf8194ad9271649275819385920a19e48b3b42f2",
      "5df726489312bcf8194ad9271649275819385920"
    ],
    "registry_keys": [
      "HKLM\\System\\CurrentControlSet\\Services\\DetrahereDriver"
    ],
    "file_paths": [
      "%SystemRoot%\\system32\\drivers\\netfilter.sys",
      "%ProgramFiles%\\Detrahere\\service.exe"
    ]
  },
  "defensive_measures": [
    "Enforce Driver Signature Enforcement (DSE) and Hypervisor-Protected Code Integrity (HVCI)",
    "Deploy Microsoft Defender Offline scan to clean persistent kernel rootkits",
    "Audit installed Windows system services for unrecognized kernel driver entries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Detrahere",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Detrahere"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Detrahere.A",
      "Trojan:Win64/Detrahere.S"
    ]
  },
  "motivation": "Kernel-Level Persistence, Traffic Manipulation & Covert Remote Access",
  "sample_hashes": []
}