{
  "family": "dfay",
  "sample_count": 300,
  "category": "trojan",
  "description": "TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engineered to establish covert initial footholds and deploy secondary crimeware payloads without leaving persistent binary artifacts on disk. Distributed predominantly through spear-phishing campaigns containing weaponized Office documents or trojanized software packages, Dfay utilizes multi-stage payload packing, dynamic Win32 API resolution to evade Import Address Table (IAT) inspection, and anti-sandbox timing checks. Upon verifying that it is running in an authentic host environment, Dfay allocates executable memory buffers inside legitimate Windows processes (such as explorer.exe or svchost.exe) and utilizes process hollowing to unpack and execute secondary backdoors, banking trojans, or ransomware droppers directly in volatile RAM.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Dfay",
    "TrojanDropper:Win32/Dfay",
    "Trojan.Dfay",
    "Win32/Dfay",
    "Dfay Dropper",
    "Trojan:Win32/Dfay"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Dfay malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dfay is an evasive Trojan dropper that uses process hollowing to inject and execute secondary malware payloads directly into legitimate Windows system processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dfay conceal its malicious activities?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dfay resolves Win32 APIs dynamically, performs anti-sandbox timing verification, and unpacks its payload entirely in-memory inside hollowed processes like explorer.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads does Dfay deploy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dfay is deployed by threat actors to deliver remote access trojans (RATs), banking infostealers, and ransomware encryptors."
      }
    },
    {
      "@type": "Question",
      "name": "How is Dfay distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dfay is distributed via spear-phishing emails carrying weaponized Office macro documents and trojanized utility software downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were associated with Dfay campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dfay campaigns leveraged Microsoft Office vulnerabilities including CVE-2012-0158 and CVE-2015-1641 in malicious document attachments."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.012",
    "T1105",
    "T1027",
    "T1059.003",
    "T1547.001",
    "T1071.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Hollowing",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "command-and-control"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2013,
  "lineage": {
    "derived_from": [],
    "variants": [
      "dfay.a",
      "dfay process hollowing dropper",
      "dfay macro loader build"
    ]
  },
  "attribution": [
    {
      "actor": "Underground Cybercrime Developers",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2012-0158",
    "CVE-2015-1641"
  ],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "HTTPS"
    ],
    "ports": [
      80,
      443,
      8080
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "1d2e3f4a5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f811",
      "89abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234571"
    ],
    "delivery": [
      "spearphishing_macro_documents",
      "trojanized_software_installers"
    ],
    "persistence": [
      "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "explorer.exe process hollowing"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Security Intelligence: TrojanDropper:Win32/Dfay Threat Details",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper:Win32/Dfay"
    },
    {
      "name": "Trend Micro Security Intelligence: Trojan.Dfay Technical Analysis",
      "url": "https://www.trendmicro.com/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2015-1641",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1641"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to stop secondary malware downloads and in-memory execution.",
    "Triage running processes with behavioral EDR tools to identify hollowed explorer.exe or svchost.exe instances.",
    "Capture live RAM dumps before rebooting to extract unencrypted second-stage payloads.",
    "Deploy security updates patching Microsoft Office vulnerabilities CVE-2012-0158 and CVE-2015-1641."
  ],
  "what_to_avoid": [
    "Do not rely solely on static antivirus scans, as Dfay's payload is decrypted only in volatile memory.",
    "Avoid opening unsolicited office attachments containing macros received from external senders.",
    "Never execute downloaded software utilities from unverified third-party file hosting platforms."
  ],
  "target_industries": [
    "financial_services",
    "healthcare",
    "manufacturing",
    "small_business",
    "consumers"
  ],
  "motivation": "Initial Access Acquisition, Evasive Staging & Secondary Malware Distribution",
  "threat_actors": [
    "Underground Cybercrime Developers"
  ],
  "target_geographies": [
    "US",
    "GB",
    "DE",
    "FR",
    "IT",
    "CA",
    "AU",
    "NL"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "defense-evasion",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}