{
  "family": "infector_ng_2004",
  "sample_count": 1500,
  "category": "trojan",
  "description": "Infector NG 2004 (Infector Next Generation, cataloged across security telemetry as Trojan:Win32/InfectorNG2004, Virus:Win32/InfectorNG, and Trojan.Win32.Infector) is a legacy dual-action file infector generator and backdoor trojan developed in 2004. Distributed as an underground builder toolkit, Infector NG 2004 enabled malware authors to generate customized trojan droppers that appended parasitic loader subroutines to local Windows portable executable (PE) files (.exe and .scr). When an infected host binary is executed, the trojan executes its malicious payload prior to transferring control back to the legitimate host application. Its capabilities include keystroke interception, registry policy tampering, downloading secondary malware packages, and establishing reverse command-and-control backdoors.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/InfectorNG2004",
    "Virus:Win32/InfectorNG",
    "Trojan.Win32.Infector",
    "Win32/InfectorNG.Trojan",
    "InfectorNG.2004"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Infector NG 2004?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Infector NG 2004 is a legacy dual-function file infector generator and backdoor trojan developed in 2004."
      }
    },
    {
      "@type": "Question",
      "name": "How does Infector NG 2004 infect executable binaries?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appends parasitic loader routines to local PE executables and modifies binary entry points to execute the trojan first."
      }
    },
    {
      "@type": "Question",
      "name": "What remote access capabilities does Infector NG 2004 provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides keystroke logging, secondary payload downloading, registry modification, and reverse command shells."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Infector NG 2004 delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Droppers delivering Infector NG 2004 have exploited common shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How should administrators clean an Infector NG 2004 infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Scan and disinfect or restore all infected PE files, remove Run registry entries, and reboot from a clean recovery image."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.002",
    "T1056.001",
    "T1059.003",
    "T1547.001",
    "T1105"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055.002",
      "name": "Process Injection: Portable Executable Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from corporate network shares to halt lateral PE file infection.",
    "Quarantine and disinfect all executables exhibiting appended parasitic sections or altered entry points.",
    "Delete persistence registry entries located under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Verify the integrity of system host executables by running sfc /scannow or restoring from known-good golden images."
  ],
  "what_to_avoid": [
    "Do not execute clean binaries from mapped drives while connected to an infected workstation.",
    "Avoid relying solely on file cleaning tools for mission-critical systems; golden image restoration is recommended."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Virus.Win32.Infector",
      "url": "https://threats.kaspersky.com/en/threat/Virus.Win32.Infector/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.InfectorNG",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/infectorng"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Win32 PE Infector Generators"
    ],
    "variants": [
      "Infector NG Build 102",
      "Infector NG 2004 Pro",
      "Win32/InfectorNG.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e",
      "0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f"
    ],
    "delivery": [
      "Parasitic file infection spreading across accessible SMB network shares",
      "Compromised utility downloads and peer-to-peer distribution bundles"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\InfectorNG",
      "Infected system executables that launch automatically during system startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}