{
  "family": "dexel",
  "sample_count": 20,
  "category": "trojan",
  "description": "Dexel (identified across antivirus research telemetry as Trojan:Win32/Dexel, TrojanDownloader:Win32/Dexel, and Backdoor:Win32/Dexel) is an evasive Windows trojan downloader and backdoor. Infiltrating target endpoints via weaponized spearphishing attachments, malicious macros, and drive-by download links, Dexel performs host profiling to detect virtualized analysis environments and security sandboxes. Once verified on a target system, Dexel establishes autostart persistence by configuring registry run entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. It establishes outbound HTTP/HTTPS command-and-control channels, transmitting encoded system inventory data (hostname, Windows version, IP address, and installed software) to remote servers, and receives instructions to download, stage, and execute secondary malware payloads including keyloggers and ransomware.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Dexel",
    "TrojanDownloader:Win32/Dexel",
    "Backdoor:Win32/Dexel",
    "Win32/Dexel",
    "Downloader.Dexel"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Dexel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dexel is a Windows trojan downloader and backdoor that delivers secondary malware payloads and executes remote commands."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dexel establish persistence on infected endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to trigger execution at logon."
      }
    },
    {
      "@type": "Question",
      "name": "What information does Dexel exfiltrate to its C2 server?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It exfiltrates system hostnames, OS version details, IP addresses, and lists of installed security software."
      }
    },
    {
      "@type": "Question",
      "name": "How is Dexel delivered to enterprise computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious email attachments, weaponized macros, and drive-by exploit downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended containment steps for Dexel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate unauthorized downloader processes, delete Run registry keys, and block remote C2 domains."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1082",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Dexel",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Dexel"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Dexel",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.dexel"
    },
    {
      "name": "VirusTotal Threat Intelligence - Dexel Sample Analysis",
      "url": "https://www.virustotal.com/gui/home/upload"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from network segments immediately to terminate active C2 control sessions.",
    "Kill unauthorized processes executing from %APPDATA% or %TEMP% directories.",
    "Inspect and remove startup values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block outbound C2 IP addresses and domains across perimeter firewalls and DNS filters.",
    "Perform a complete antimalware scan to locate and remove any secondary payloads downloaded by Dexel."
  ],
  "what_to_avoid": [
    "Do not allow the infected host to maintain internet connectivity during analysis.",
    "Do not assume removing the initial dropper executable cleans secondary payloads."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Financial Services",
    "Commercial Enterprises"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Operators"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Secondary Payload Distribution & Remote Command Execution",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}