{
  "family": "institution_2004",
  "sample_count": 0,
  "category": "trojan",
  "description": "Institution 2004 (cataloged across security software as Trojan:Win32/Institution2004, Backdoor.Win32.Institution, and Trojan.Institution) is an early 2000s Delphi-based remote access trojan and backdoor suite that circulated across early underground cybercrime and malware authoring forums. Engineered to establish persistent remote administrative access, Institution 2004 drops a hidden background daemon onto infected Windows hosts, opens reverse command sockets to attacker IP addresses, records keyboard entries, extracts system environment variables, and enables remote operators to execute shell commands, manage files, and alter system configurations.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Institution2004",
    "Backdoor.Win32.Institution",
    "Trojan.Institution",
    "Win32/Institution.RAT",
    "Institution.2004.Backdoor"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Institution 2004 malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Institution 2004 is a classic Delphi remote access trojan and backdoor developed in 2004 for unauthorized system surveillance."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Institution 2004 provide to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides keystroke logging, reverse command shell execution, system reconnaissance, and file manipulation."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors propagate Institution 2004?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized freeware software."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Institution 2004 delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Droppers delivering Institution 2004 have exploited common shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Institution 2004?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy modern endpoint protection, audit registry Run keys, monitor outbound non-standard TCP traffic, and restrict administrative privileges."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to terminate active reverse command sessions.",
    "Kill active Institution 2004 background processes and child cmd.exe shells.",
    "Purge persistence entries under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Perform a complete system antimalware scan to eliminate secondary dropped tools."
  ],
  "what_to_avoid": [
    "Do not execute software utilities downloaded from unverified peer-to-peer file-sharing networks.",
    "Avoid bypassing operating system warnings when launching unsigned executable binaries."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Institution",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Institution/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Institution",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/institution"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi Backdoor Architectures"
    ],
    "variants": [
      "Institution 2004 v1.0",
      "Institution 2004 Pro",
      "Win32/Institution.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f",
      "1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "IRC DCC file transfer lures and malicious download links"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Institution2004",
      "Startup folder shortcut in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}