{
  "family": "evital",
  "sample_count": 40,
  "category": "trojan",
  "description": "Evital (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Evital, Trojan.Win32.Evital, and Win32/Evital) is a stealthy Windows trojan and initial access dropper active since 2017. Designed to bypass perimeter security controls, Evital is distributed via weaponized email attachments, cracked application downloads, and drive-by download portals. Upon execution, the malware profiles the host environment to detect analysis sandboxes, establishes persistence via Windows Registry Run keys, and drops randomized executable stagers into user temporary directories. Evital establishes encrypted C2 beacons, providing remote operators with capabilities to deploy secondary malware payloads such as ransomware and banking trojans.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Evital",
    "Trojan.Win32.Evital",
    "Win32/Evital",
    "Trojan:Win32/Evital!rfn",
    "Evital Stager"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Evital?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Evital is a stealthy Windows trojan that acts as an initial access dropper and stager for secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Evital infect computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly infiltrates systems via freeware software bundlers, pirated application patches, and phishing links."
      }
    },
    {
      "@type": "Question",
      "name": "Where does Evital drop its execution artifacts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It unpacks randomized binaries and staging files into user %LocalAppData%\\Temp directories."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary threats are delivered by Evital?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It delivers high-severity payloads including ransomware, information stealers, and banking trojans."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders clean an Evital infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a Microsoft Defender Offline scan, clean the %LocalAppData%\\Temp folder, and remove rogue Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1071.001",
    "T1082",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Software Downloads",
    "Cracked Application Installers",
    "Spearphishing Email Links"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "Host Environment Fingerprinting",
    "Encrypted C2 Telemetry Beaconing",
    "Temporary Directory File Dropping",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded system GUIDs and MAC addresses to C2 servers",
      "Outbound TLS connections fetching secondary executable stages"
    ],
    "evasion_techniques": [
      "Execution from volatile temporary user directories (%LocalAppData%\\Temp)",
      "Dynamic API resolution to evade static heuristic import table flags"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9271649275819385920a19e48b3b42f2b3e449a5",
      "c3f8194ad9271649275819385920a19e48b3b42f"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\EvitalService"
    ],
    "file_paths": [
      "%LocalAppData%\\Temp\\evital_loader.exe",
      "%AppData%\\Evital\\client.bin"
    ]
  },
  "defensive_measures": [
    "Block executable execution from user temp paths (%LocalAppData%\\Temp)",
    "Deploy endpoint detection and response (EDR) to monitor unauthorized child process spawning",
    "Audit Windows Registry Run keys regularly for unknown persistence entries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Evital",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Evital"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Evital.A",
      "Trojan:Win32/Evital!rfn"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Malware Staging",
  "sample_hashes": []
}