{
  "family": "jps",
  "sample_count": 0,
  "category": "trojan",
  "description": "JPS (cataloged across security software as Trojan:Win32/JPS, Virus:Win32/JPS, and Trojan.Win32.JPS) is the compiled runtime client component generated by the JPS Virus Maker framework during the early 2000s underground virus authoring era. When executed, JPS drops secondary trojan components into the Windows system directory, establishes registry Run key persistence, modifies executable file associations, and attempts to spread locally across connected drives and shared folders. The trojan executes pre-configured disruptive subroutines designed by the toolkit operator, including terminating antivirus processes, disabling system management tools, and establishing reverse backdoor connections.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/JPS",
    "Virus:Win32/JPS",
    "Trojan.Win32.JPS",
    "Win32/JPS.Trojan",
    "JPS.Client"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the JPS malware threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "JPS is the compiled client runtime generated by the JPS Virus Maker kit, capable of system modification and backdoor access."
      }
    },
    {
      "@type": "Question",
      "name": "How does JPS establish persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds autostart registry entries under HKLM and HKCU Run keys and alters system executable file associations."
      }
    },
    {
      "@type": "Question",
      "name": "What disruptive actions are performed by JPS?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It disables Windows administrative tools like Task Manager and Registry Editor and terminates security scanning processes."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to JPS delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering JPS droppers have exploited document and shortcut flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be cleaned from JPS?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Restore disabled registry administrative policies, terminate JPS processes, delete Run keys, and perform full antimalware scans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1112",
    "T1562.001",
    "T1059.003",
    "T1105"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the affected machine to block active command sessions and prevent local network share propagation.",
    "Kill active JPS binaries and spawned shell processes running out of %SYSTEMROOT%\\System32.",
    "Restore disabled administrative tooling (Task Manager, Regedit) by purging malicious registry policy keys.",
    "Scan all attached storage volumes to detect and remove residual JPS dropper binaries."
  ],
  "what_to_avoid": [
    "Do not execute software utilities downloaded from unverified peer-to-peer file-sharing networks.",
    "Avoid bypassing operating system warnings when launching unsigned executable binaries."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.JPS",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.JPS/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.JPS",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/jps"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "jps_virus_maker"
    ],
    "variants": [
      "JPS Client v1.0",
      "JPS Client v2.0",
      "Win32/JPS.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d",
      "4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Compromised software freeware download portals and bundled installers"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JPSClient",
      "Startup folder shortcut placed under %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}