{
  "family": "kuluoz",
  "sample_count": 22,
  "category": "trojan",
  "description": "Kuluoz (identified across antimalware research as Trojan:Win32/Kuluoz, TrojanDownloader:Win32/Kuluoz, and closely associated with the historic Asprox botnet infrastructure) is a modular Windows trojan downloader and spam botnet implant. Active in widespread phishing and malicious spam operations disguised as postal delivery notifications (FedEx, UPS, DHL, USPS) or court summonses, Kuluoz executes an encrypted loader that checks for sandbox environments and debuggers. Upon infection, it configures persistence through startup registry keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and injects malicious code into legitimate processes such as svchost.exe. Kuluoz establishes encrypted C2 communications over HTTP/HTTPS, receiving instructions to send high-volume spam emails, harvest stored credentials, scan for SQL injection vulnerabilities across external websites, and download secondary malware families such as ransomware and banking trojans.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Kuluoz",
    "TrojanDownloader:Win32/Kuluoz",
    "Trojan:Win32/Kuluoz.A",
    "Trojan:Win32/Kuluoz.B",
    "Worm:Win32/Asprox"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Kuluoz?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kuluoz is a modular trojan downloader and botnet implant linked to Asprox, used for mass spam distribution and malware delivery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kuluoz propagate to victim endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via spam emails masquerading as shipping notifications from postal carriers like FedEx, UPS, or DHL."
      }
    },
    {
      "@type": "Question",
      "name": "What payloads are distributed by Kuluoz?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kuluoz delivers secondary payloads including banking trojans, ransomware, credential stealers, and spam modules."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kuluoz maintain persistence on systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes auto-start entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and injects code into system processes like svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps are effective against Kuluoz?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the host, terminate injected processes, remove startup registry keys, block C2 domains, and perform an enterprise antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.003",
    "T1055",
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Kuluoz",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Kuluoz"
    },
    {
      "name": "US-CERT / CISA Alert on Asprox/Kuluoz Botnet Activity",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    },
    {
      "name": "Malwarebytes Threat Intelligence - Kuluoz Malware Analysis",
      "url": "https://www.malwarebytes.com/blog/threat-intelligence"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the infected host from the enterprise network immediately to stop spam distribution and payload downloads.",
    "Kill injected system processes and delete staged executable droppers in %TEMP% and %APPDATA%.",
    "Remove Run registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block identified C2 IP addresses, domains, and outbound SMTP traffic from unauthorized endpoints.",
    "Conduct full antimalware scanning to detect and eliminate secondary payloads dropped by Kuluoz."
  ],
  "what_to_avoid": [
    "Do not allow infected systems to send outbound SMTP or HTTP traffic.",
    "Do not assume removing the primary loader cleans secondary injected modules."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Logistics & Shipping",
    "Financial Institutions",
    "E-commerce"
  ],
  "target_geographies": [
    "Global",
    "North America",
    "Europe"
  ],
  "threat_actors": [
    "Asprox Botnet Syndicate"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Botnet Expansion, Spamming & Secondary Malware Distribution",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}