{
  "family": "hesv",
  "sample_count": 93,
  "category": "trojan",
  "description": "Hesv (cataloged across security intelligence repositories under identifiers including Trojan:Win32/Hesv, Trojan.Win32.Hesv, and Trojan.MSIL.HESV) is a versatile Windows trojan, credential harvester, and screen-locking ransomware precursor first identified in 2014. Distributed primarily through compromised freeware repositories, pirated software cracks, and spam email campaigns, Hesv operates both as a standalone surveillance module and as a multi-stage loader. Upon infection, Hesv conducts deep environment interrogation to detect sandbox hypervisors and security debugging tools before dropping persistence files into user directories. Depending on the specific variant deployed (.gen, .fulq), Hesv captures user keystrokes, takes periodic screenshots of desktop activity, extracts saved browser passwords and cookies, or locks the host desktop display with an extortion notice demanding ransom. Furthermore, Hesv establishes encrypted command-and-control communication to download and stage secondary payloads including cryptocurrency miners and network discovery tools.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Hesv",
    "Trojan.Win32.Hesv",
    "Trojan.MSIL.HESV",
    "Win32/Hesv"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Hesv?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hesv is a Windows trojan and information stealer with screen-locking and secondary malware delivery capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hesv compromise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through deceptive freeware bundles, software cracks, keygens, and malicious phishing attachments."
      }
    },
    {
      "@type": "Question",
      "name": "What data does Hesv steal from infected computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It steals keystrokes, desktop screenshots, stored web browser passwords, session cookies, and system metadata."
      }
    },
    {
      "@type": "Question",
      "name": "Can Hesv lock or encrypt files on a computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Certain variants exhibit screen-locker behavior, preventing user desktop access until remediated or extortion demands are shown."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove Hesv infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect from the network, boot into Safe Mode if screen locking occurs, run a full offline antivirus scan, and reset account credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1204.002",
    "T1059.003",
    "T1547.001",
    "T1056.001",
    "T1113",
    "T1082",
    "T1486",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Hesv payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Hesv persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Extortion & Espionage",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Pirated Software & Keygens",
    "Phishing Emails with Malicious Attachments",
    "Drive-by Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Keystroke Logging",
    "Screenshot Capture",
    "Credential Harvesting",
    "Screen Locker Ransomware",
    "Secondary Payload Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "MSIL .NET Executable"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting credentials and screenshots to C2",
      "Secondary payload download requests over HTTP"
    ],
    "evasion_techniques": [
      "Sandbox hypervisor checks",
      "Process injection into system processes"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Hesv",
      "Scheduled Task created via schtasks.exe"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "User credentials, desktop accessibility, financial information"
  },
  "lineage": {
    "derived_from": [
      "Generic Win32 Trojan Stealers"
    ],
    "variants": [
      "Hesv.A",
      "Hesv.fulq",
      "Hesv.gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b",
      "2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f"
    ],
    "delivery": [
      "keygen_patch.exe",
      "hesv_payload.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HesvService",
      "%AppData%\\Hesv\\hesv_core.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Hesv",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Hesv"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Hesv",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Hesv/"
    }
  ]
}