{
  "family": "diztakun",
  "sample_count": 42,
  "category": "trojan",
  "description": "Diztakun (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Diztakun, Trojan.Win32.Diztakun, and Spyware.Diztakun) is a covert Windows trojan and spyware threat active since 2016. Infiltrating endpoints primarily through malicious email attachments, cracked software packages, and drive-by web exploits, Diztakun executes surveillance and system modification routines. Upon gaining execution, the malware establishes persistence through Windows Registry Run keys, suppresses native system alert mechanisms, and profiles system hardware and user accounts. Diztakun can log user keystrokes, extract credentials from local storage, and establish encrypted C2 beacons to download and execute secondary malware payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Diztakun",
    "Trojan.Win32.Diztakun",
    "Spyware.Diztakun",
    "Win32/Diztakun",
    "Trojan:Win32/Diztakun!rfn"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Diztakun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Diztakun is a covert Windows trojan and spyware family designed to surveil users and download secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Diztakun infect Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious phishing email attachments, weaponized document macros, and cracked software installers."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Diztakun implement?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It captures typed keystrokes, harvests system configuration data, and extracts stored user credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does Diztakun maintain persistence on endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows Registry Run keys to automatically launch its executable payload at system boot."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams remediate Diztakun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan, terminate rogue processes, and change compromised account credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555.003",
    "T1547.001",
    "T1105",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Cracked Software & Keygen Utilities",
    "Drive-By Web Exploits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Keystroke Logging (Keylogger)",
    "Browser Credential Harvesting",
    "System Hardware & User Profiling",
    "Secondary Payload Downloading",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded system telemetry and keylog buffers to C2 servers"
    ],
    "evasion_techniques": [
      "Process injection into standard Windows background services",
      "Obfuscated internal API calls using dynamic runtime resolution"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9385920a19e48b3b42f2b3e449a57291dc8f781b",
      "726489312bcf8194ad9271649275819385920a19"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DiztakunSvc"
    ],
    "file_paths": [
      "%AppData%\\Diztakun\\diztakun.exe",
      "%Temp%\\diztakun_log.tmp"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection rules detecting unauthorized Windows API keylogging hooks (SetWindowsHookEx)",
    "Enforce email filtering to quarantine attachments with executable or script extensions",
    "Audit Windows Registry Run keys regularly for unknown executables in user profiles"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Diztakun",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Diztakun"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Diztakun.A",
      "Trojan:Win32/Diztakun!rfn"
    ]
  },
  "motivation": "Information Theft, Endpoint Surveillance & Secondary Threat Staging",
  "sample_hashes": []
}