{
  "family": "llac",
  "sample_count": 104,
  "category": "trojan",
  "description": "Llac (cataloged across security telemetry as Trojan:Win32/Llac, Trojan.Win32.Llac, and Trojan:Win32/Llac.A) is a stealthy information-stealing trojan and surveillance threat active across Windows platforms since 2013. Designed primarily to harvest sensitive user credentials, browser autocomplete data, and system configurations, Llac is delivered via deceptive email attachments, trojanized key generators, and bundled freeware cracks. Upon execution on an endpoint, Llac verifies the execution environment, using anti-debugging routines to bypass basic sandbox analysis. It hooks Windows user input APIs to log keystrokes, extract saved passwords and cookies from installed web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), and harvest local system metadata including active process lists, IP configurations, and user privilege levels. The trojan secures persistence by adding autostart values to the Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and establishes encrypted outbound HTTP communication with attacker-controlled command-and-control servers to exfiltrate stolen credentials and download secondary malicious payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Llac",
    "Trojan.Win32.Llac",
    "Trojan:Win32/Llac.A",
    "Trojan:Win32/Llac.B"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Trojan:Win32/Llac malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Llac is an information-stealing Windows trojan designed to log keystrokes, steal browser credentials, and exfiltrate host data."
      }
    },
    {
      "@type": "Question",
      "name": "How does Llac gain initial access to endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is predominantly distributed through weaponized email attachments, software cracks, keygens, and deceptive freeware downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What sensitive information does Llac target?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets browser-saved passwords, session cookies, cryptocurrency wallets, user keystrokes, and operating system metadata."
      }
    },
    {
      "@type": "Question",
      "name": "How does Llac achieve persistence on infected systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries into HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run masquerading as legitimate software."
      }
    },
    {
      "@type": "Question",
      "name": "What containment actions are recommended for Llac?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, revoke exposed account credentials, terminate malicious processes, and perform full offline remediation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1055",
    "T1105",
    "T1547.001",
    "T1082",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the endpoint from network and internet interfaces to halt credential exfiltration to the C2 server.",
    "Force credential resets for all email, banking, and enterprise accounts authenticated on the compromised host.",
    "Capture a memory dump to extract injected modules and identify active C2 IP addresses and exfiltration domains.",
    "Remove persistent registry run keys and scan storage drives using an offline antimalware scanner like Microsoft Defender Offline."
  ],
  "what_to_avoid": [
    "Do not allow the infected host to remain on the network, as the trojan continuously transmits keystroke logs and browser cookies.",
    "Avoid relying solely on file deletion, as active in-memory threads can regenerate persistence mechanisms upon user logon."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Corporate Workstations"
  ],
  "motivation": "Information Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "credential_access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "lineage": {
    "derived_from": [
      "Classic Windows Password Stealers"
    ],
    "variants": [
      "Llac.A",
      "Llac.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d",
      "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e"
    ],
    "delivery": [
      "Malicious email attachments disguised as invoices or receipts",
      "Trojanized utility downloads and game keygens"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LlacAgent",
      "Dropped executable in %AppData%\\Local"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Llac",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Llac"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Llac",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.llac"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}