{
  "family": "jacard",
  "sample_count": 69,
  "category": "trojan",
  "description": "Jacard (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Jacard, Trojan.Jacard, and W32/Jacard) is a sophisticated Windows trojan and initial access stager active since 2013. Designed to compromise host endpoint integrity and establish covert surveillance, Jacard is distributed via malicious email attachments, compromised download portals, and pirated software cracks. Upon execution, Jacard unpacks in-memory, alters system settings to hide its background execution, and establishes persistence through Windows registry Run keys and scheduled tasks. Jacard hooks web browsers to intercept session traffic, collects host system configuration data and user credentials, and communicates with remote command-and-control (C2) servers over encrypted HTTP. Furthermore, it operates as a secondary downloader, retrieving and executing secondary malware modules including ransomware precursors, keyloggers, and cryptocurrency miners.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Jacard",
    "Trojan.Jacard",
    "W32/Jacard"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Jacard?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jacard is a Windows trojan and initial access stager that steals host data and downloads secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jacard compromise target endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through phishing attachments, drive-by downloads, and trojanized software activators."
      }
    },
    {
      "@type": "Question",
      "name": "What data is collected by Jacard?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It collects browser cookies, credentials, host hardware configurations, and active user session data."
      }
    },
    {
      "@type": "Question",
      "name": "What persistence mechanisms are employed by Jacard?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows registry Run keys and creates scheduled tasks to automatically launch on boot."
      }
    },
    {
      "@type": "Question",
      "name": "How should administrators remediate a Jacard compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect the host, run an offline antimalware scan, reset user credentials, and inspect scheduled tasks."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1555.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Jacard frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Credential Theft & Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Email Attachments",
    "Compromised Download Portals",
    "Software Cracks & Keygens"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Credential & Cookie Theft",
    "Secondary Malware Staging",
    "Registry Autostart Persistence",
    "Scheduled Task Creation",
    "Encrypted HTTP C2 Beaconing"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting host hardware profiling data",
      "Encrypted traffic exchanges with remote C2 IP endpoints"
    ],
    "evasion_techniques": [
      "In-memory payload unpacking to avoid file-based heuristic triggers",
      "Process injection into background svchost.exe instances"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JacardClient",
      "Windows Task Scheduler entries under %AppData%\\Jacard"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Confidential credential leakage, persistent backdoor staging, network resource degradation"
  },
  "lineage": {
    "derived_from": [
      "Win32 Information Stealer Frameworks"
    ],
    "variants": [
      "Jacard.A",
      "Jacard.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d",
      "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e"
    ],
    "delivery": [
      "software_setup.exe",
      "jacard_patch.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JacardService",
      "%AppData%\\Jacard\\jacard.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Jacard",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Jacard"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Jacard Overview",
      "url": "https://securelist.com"
    }
  ]
}