{
  "family": "erazer",
  "sample_count": 1500,
  "category": "trojan",
  "description": "Erazer (identified across antivirus engines as Trojan:Win32/Erazer and Backdoor.Erazer) is a classic dual-function Remote Access Trojan (RAT) and disruptive disk wiper originally surfaced in the mid-2000s cybercrime landscape. Built upon modular Delphi architecture, Erazer was engineered to provide remote operators with complete administrative dominion over compromised Windows endpoints. Beyond standard RAT capabilities such as keystroke logging, active window spying, process enumeration, and reverse command shells, Erazer features deliberate destructive subroutines designed to wipe user files, overwrite master boot record (MBR) structures, and zero-fill critical documents upon receiving a specific kill command from the command-and-control server. Attackers distributed Erazer through peer-to-peer file sharing networks like KaZaA and eMule masked as software cracks and game cheat trainers. Once launched, Erazer establishes registry persistence, terminates local security processes, and disables system management utilities like Task Manager and Regedit.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Erazer",
    "Backdoor.Erazer",
    "Win32.Erazer.RAT",
    "Trojan.KillFiles.Erazer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Erazer malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Erazer is a legacy Delphi-based Remote Access Trojan (RAT) and wiper capable of remote surveillance and deliberate file destruction."
      }
    },
    {
      "@type": "Question",
      "name": "What destructive capabilities does Erazer possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Upon remote command, Erazer can zero-fill targeted file directories, overwrite boot sectors, and corrupt critical system binaries."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors distribute Erazer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Erazer was primarily distributed across peer-to-peer (P2P) networks disguised as cracked software, keygens, and game utilities."
      }
    },
    {
      "@type": "Question",
      "name": "What defense evasion techniques does Erazer use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Erazer actively modifies Windows registry policies to disable the Task Manager, Registry Editor, and security alerting dialogs."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be protected from Erazer and related RATs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Organizations should restrict peer-to-peer file-sharing software, enforce endpoint privilege management, and deploy modern EDR monitoring."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056",
    "T1059",
    "T1106",
    "T1112",
    "T1071",
    "T1485"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol",
      "tactic": "Command and Control"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Disconnect infected endpoints from network environments to halt ongoing remote operator command execution.",
    "Kill active Erazer payload processes and unhook keyboard intercept hooks via administrative tools.",
    "Restore disabled administrative tooling (Task Manager, Regedit) by purging malicious registry policy keys.",
    "Verify data integrity across local volumes and restore any zeroed or wiped data from immutable backups."
  ],
  "what_to_avoid": [
    "Do not download or execute software cracks, keygens, or pirated software from unverified file-sharing sources.",
    "Avoid rebooting systems while active wiper routines are running to prevent partial master boot record corruption."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Erazer",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Erazer/"
    },
    {
      "name": "Sophos Security Advisory - W32/Erazer-A Trojan Breakdown",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Erazer-A"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Espionage and Sabotage",
  "lineage": {
    "derived_from": [
      "Delphi Backdoor Architectures"
    ],
    "variants": [
      "Erazer Lite",
      "Win32/Erazer.v2"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "9f83a4561b369c02e1b12b50937a892b1a5e1e1a5f4c219468e4a9e5b721869a",
      "2c5a987ef423bc5e109d784a32b98e1f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks (eMule, KaZaA) disguised as key generators and media players",
      "Compromised software freeware download portals and bundled installers"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ErazerServer",
      "Creation of hidden auto-start Windows service keys under HKLM\\SYSTEM\\CurrentControlSet\\Services"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}