{
  "family": "guagua",
  "sample_count": 22,
  "category": "trojan",
  "description": "Guagua (classified in antimalware telemetry under signatures including Trojan:Win32/Guagua, Trojan:Win32/Guagua.A, and Backdoor:Win32/Guagua) is a modular Windows remote access trojan and backdoor. Infiltrating victim environments through malicious drive-by downloads, phishing lures, and software cracking utilities, Guagua implements defensive evasion mechanisms including API hooking detection and virtual sandbox bypasses. It establishes autostart persistence by creating registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background service components. Guagua connects to remote command-and-control servers via TCP sockets or HTTP sessions, allowing remote operators to perform keystroke logging, capture screen snapshots, execute command-line instructions, harvest stored credentials, and download secondary malware modules.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Guagua",
    "Trojan:Win32/Guagua.A",
    "Backdoor:Win32/Guagua",
    "Win32/Guagua",
    "Backdoor.Guagua"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Guagua?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Guagua is a Windows remote access trojan and backdoor that gives unauthorized attackers interactive remote control of infected systems."
      }
    },
    {
      "@type": "Question",
      "name": "What remote capabilities are provided by Guagua?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides keystroke logging, screen capturing, credential harvesting, command execution, and arbitrary payload staging."
      }
    },
    {
      "@type": "Question",
      "name": "How does Guagua maintain persistent access across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes auto-start values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers background services."
      }
    },
    {
      "@type": "Question",
      "name": "How does Guagua infiltrate enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infiltrates endpoints through phishing email attachments, weaponized cracked software installers, and drive-by web downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What are the key incident response actions for Guagua?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate suspicious backdoor processes, remove Run keys and service entries, and reset compromised account credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Guagua",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Guagua"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Guagua",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.guagua"
    },
    {
      "name": "VirusTotal Threat Intelligence",
      "url": "https://www.virustotal.com/gui/home/upload"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from network segments immediately to terminate active C2 control sessions.",
    "Kill unauthorized processes executing from %APPDATA% or %TEMP% directories.",
    "Inspect and delete startup values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block outbound C2 IP addresses and domains across perimeter firewalls and web proxies.",
    "Audit access logs for signs of lateral movement and force reset passwords for accounts logged in during the compromise."
  ],
  "what_to_avoid": [
    "Do not allow the infected host to communicate outbound while conducting forensic analysis.",
    "Do not assume removing the trojan binary revokes credentials that may have already been exfiltrated."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Financial Services",
    "Technology"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Operators"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Interactive Remote Control, Surveillance & Espionage",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}