{
  "family": "downeks",
  "sample_count": 25,
  "category": "trojan_downloader",
  "description": "Downeks (identified in security vendor telemetries under signatures including TrojanDownloader:Win32/Downeks, Trojan:Win32/Downeks, and Trojan.Downeks) is an evasive multi-stage Windows trojan downloader active since 2016. Infiltrating endpoints primarily through phishing email attachments and malicious software downloads, Downeks functions as an initial staging loader for secondary crimeware threats. Upon execution, Downeks performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files—frequently modular banking trojans, cryptocurrency miners, and ransomware—saving and executing them from temporary directories or directly into memory via process hollowing.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Downeks",
    "Trojan:Win32/Downeks",
    "Trojan.Downeks",
    "Win32/Downeks",
    "TrojanDownloader:Win32/Downeks.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Downeks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Downeks is a stealthy Windows trojan downloader that fingerprints systems and downloads secondary malware like miners and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Downeks evade detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtual machines, uses PEB hashing for dynamic API resolution, and hollows code into svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are dropped by Downeks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Downeks to deploy cryptocurrency miners, banking trojans, credential stealers, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Downeks establish persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under CurrentVersion\\Run and registers scheduled background tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to a Downeks infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, review process lineage for injected svchost.exe processes, and conduct full remediation of dropped payloads."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1497.001",
    "T1055",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Trojanized Freeware Utilities",
    "Drive-by Download Exploits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Secondary Payload Downloading",
    "Process Injection into svchost.exe",
    "Hypervisor & Sandbox Environment Checks",
    "Host Telemetry Gathering & Beaconing",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP/HTTPS POST beacons transmitting host hardware identifiers and user privileges",
      "Outbound HTTP GET requests fetching XOR-encrypted secondary binary blobs disguised as font or image files"
    ],
    "evasion_techniques": [
      "Dynamic API resolution through PEB hash lookups to conceal API imports from static analysis",
      "Checking for hypervisor registry artifacts and terminating execution if detected"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7",
      "6ae0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DowneksLoader",
      "HKCU\\Software\\Downeks"
    ],
    "file_paths": [
      "%Temp%\\downeks.exe",
      "%AppData%\\Downeks\\stage.dat",
      "%LocalAppdata%\\Temp\\dl_cache.bin"
    ]
  },
  "defensive_measures": [
    "Implement Software Restriction Policies to block executable execution from %Temp% and %AppData%",
    "Deploy secure email gateways that quarantine macro-enabled office documents from untrusted external senders",
    "Configure EDR alerts for rapid downloader execution followed by code injection into system processes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Downeks",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Downeks"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Downeks",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Downeks.A",
      "TrojanDownloader:Win32/Downeks.B"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Malware Delivery",
  "sample_hashes": []
}