{
  "family": "jps_virus_maker",
  "sample_count": 0,
  "category": "tool",
  "description": "JPS Virus Maker (cataloged across security software as HackTool:Win32/JPSVirusMaker, Tool:Win32/JPS, and Constructor.Win32.JPS) is a classical GUI-based virus creation kit and malware generator from the early 2000s cybercrime era. Similar to Senna Spy and VBSWG toolkits, JPS Virus Maker allowed novice cybercriminals to generate custom Windows trojans and destructive script payloads by selecting pre-configured options (such as disabling Windows Task Manager, formatting floppy drives, modifying desktop registry policies, and injecting backdoor ports) without writing code.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/JPSVirusMaker",
    "Tool:Win32/JPS",
    "Constructor.Win32.JPS",
    "Win32/JPS.Constructor",
    "JPSVirusMaker.Tool"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is JPS Virus Maker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "JPS Virus Maker is a legacy GUI malware generator used by novice attackers to compile custom trojan droppers."
      }
    },
    {
      "@type": "Question",
      "name": "What options were configurable in JPS Virus Maker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Options included disabling administrative tools, registry modification, autostart persistence, and dropper creation."
      }
    },
    {
      "@type": "Question",
      "name": "Why is JPS Virus Maker classified as a hacktool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is designed exclusively to automate the creation and obfuscation of malicious executable trojans."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been associated with JPS-generated malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Payloads generated by the kit have historically exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams mitigate JPS-generated payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint antimalware heuristics, enforce application control policies, and monitor registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1587.001",
    "T1562.001",
    "T1112",
    "T1547.001",
    "T1027"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1587.001",
      "name": "Develop Capabilities: Malware",
      "tactic": "Resource Development"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine and delete all instances of the JPS Virus Maker generator toolkit from the filesystem.",
    "Scan endpoints for any compiled output binaries generated using the toolkit and eliminate them.",
    "Restore disabled registry administrative policies using administrative group policy overrides.",
    "Audit file servers and shared network drives for generated dropper executables."
  ],
  "what_to_avoid": [
    "Do not execute software downloaded from underground malware author forums or hacking repositories.",
    "Avoid disabling antimalware protection to run compiled hacktools or generators."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Constructor.Win32.JPS",
      "url": "https://threats.kaspersky.com/en/threat/Constructor.Win32.JPS/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - HackTool.Win32.JPS",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/jpsmaker"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "Malware Constructor Frameworks"
    ],
    "variants": [
      "jps",
      "JPS Virus Maker 2.0",
      "Win32/JPSMaker.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e",
      "5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a"
    ],
    "delivery": [
      "Underground hacker forums and malware repository archive packages",
      "Peer-to-peer file-sharing networks packaged as hacking utility collections"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JPSMakerPersistence",
      "Registry policy modification disabling Task Manager and Regedit"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}