{
  "family": "jaik",
  "sample_count": 39,
  "category": "trojan",
  "description": "Jaik (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Jaik, Trojan:Win32/Jaik!pz, and Trojan.Win32.Jaik) is a covert Windows trojan and initial access stager active since 2017. Infiltrating endpoints primarily through third-party freeware bundles, cracked software utilities, and weaponized email attachments, Jaik executes reconnaissance and dropper routines on target hosts. Upon execution, the malware establishes persistence via Windows Registry Run keys, drops auxiliary binaries into user temporary directories, and communicates with remote command-and-control servers over encrypted channels to stage secondary malicious payloads such as ransomware and infostealers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Jaik",
    "Trojan:Win32/Jaik!pz",
    "Trojan:Win32/Jaik!MTB",
    "Win32/Jaik",
    "Trojan.Win32.Jaik"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Jaik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jaik is a Windows trojan and initial access stager designed to profile hosts and download secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jaik infect Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly delivered through pirated software, software cracks, keygens, and malicious phishing attachments."
      }
    },
    {
      "@type": "Question",
      "name": "What do suffixes like !pz or !MTB mean on Jaik detections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They indicate heuristic and machine learning detections by Microsoft Defender flagging malicious behavioral patterns."
      }
    },
    {
      "@type": "Question",
      "name": "Where does Jaik drop its secondary files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It drops staging executables and configuration caches into user %AppData% and %Temp% directories."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders remediate a Jaik infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a Microsoft Defender Offline scan, clean temporary Windows directories, and audit Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1071.001",
    "T1082",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Software Cracks & Keygens",
    "Spearphishing Email Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "Host Environment Profiling",
    "Encrypted C2 Telemetry Beaconing",
    "Temporary Directory File Dropping",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded system telemetry to C2 servers",
      "Outbound TLS connections fetching secondary executable stages"
    ],
    "evasion_techniques": [
      "Execution from volatile temporary user directories (%Temp%)",
      "Dynamic API resolution to evade static heuristic import table flags"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "726489312bcf8194ad9271649275819385920a19",
      "2b3e449a57291dc8f781bb49f8b15df726489312"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JaikService"
    ],
    "file_paths": [
      "%Temp%\\jaik_loader.exe",
      "%AppData%\\Jaik\\client.bin"
    ]
  },
  "defensive_measures": [
    "Block executable execution from user temp paths (%Temp%)",
    "Deploy endpoint detection and response (EDR) to monitor unauthorized child process spawning",
    "Audit Windows Registry Run keys regularly for unknown persistence entries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Jaik",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Jaik"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Jaik.A",
      "Trojan:Win32/Jaik!pz"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Threat Staging",
  "sample_hashes": []
}