{
  "family": "hack_a_tack",
  "sample_count": 1500,
  "category": "trojan",
  "description": "Hack a Tack (cataloged across antivirus vendors as Trojan:Win32/HackaTack, Backdoor.HackaTack, and Trojan.Hack-a-Tack) is a classic remote access trojan and backdoor initially surfaced during the late 1990s and early 2000s cybercrime era. Developed in Borland Delphi by French programmers, Hack a Tack historically established listening servers over TCP port 31258 (and port 31587 in variant builds). The trojan provides remote operators with unauthorized dominion over infected Windows machines, including taking remote desktop screenshots, logging user keystrokes, displaying disruptive message pop-ups, manipulating local file directories, downloading and executing secondary binaries, and performing remote reboots. Hack a Tack was widely distributed via peer-to-peer file sharing networks, IRC DCC file transfers, and Trojanized freeware game installers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/HackaTack",
    "Backdoor.HackaTack",
    "Trojan.Hack-a-Tack",
    "Win32/HackaTack.RAT",
    "Backdoor.Win32.HackATack"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Hack a Tack malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hack a Tack is a classic Delphi remote access trojan and backdoor developed in France that operates over TCP port 31258."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions can Hack a Tack execute?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Actions include taking screen captures, logging keystrokes, manipulating files, executing shell commands, and remote rebooting."
      }
    },
    {
      "@type": "Question",
      "name": "How did attackers historically distribute Hack a Tack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat file transfers, and trojanized game cracks."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Hack a Tack delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Droppers delivering Hack a Tack payloads have exploited common shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be safeguarded against Hack a Tack and legacy RATs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block default listening ports (31258/31587) at perimeter firewalls, enforce endpoint protection, and audit registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1071",
    "T1547.001",
    "T1105"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate infected hosts and block TCP ports 31258 and 31587 across local firewalls.",
    "Terminate active Hack a Tack background server processes and remove autostart entries.",
    "Purge persistence entries under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Perform a comprehensive full-disk antivirus scan to eliminate all dropped secondary payloads."
  ],
  "what_to_avoid": [
    "Do not expose legacy unencrypted remote administration listening ports to public network interfaces.",
    "Avoid executing unknown executable files downloaded from unverified file-sharing sources."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.HackaTack",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.HackaTack/"
    },
    {
      "name": "Sophos Threat Center - Troj/HackaTack-A Breakdown",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~HackaTack-A"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2000,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "French Delphi RAT Architectures"
    ],
    "variants": [
      "HackaTack 1.0",
      "HackaTack 2000",
      "HackaTack Pro"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b5a",
      "1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "IRC DCC file transfer lures and malicious download links"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HackaTackServer",
      "Registry RunServices entry under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}