{
  "family": "mudrop",
  "sample_count": 45,
  "category": "trojan",
  "description": "Mudrop (cataloged across security vendors under signatures including Trojan-Dropper.Win32.Mudrop, Trojan:Win32/Mudrop, and Trojan.Mudrop) is a high-volume Windows trojan dropper family engineered to deliver secondary malicious payloads. Distributed via malicious torrent archives, deceptive software cracks, and spam email attachments, Mudrop contains multiple encrypted binaries embedded within its resource section. Upon execution, the dropper decrypts its internal payloads into %Temp% or %AppData%, executes them with elevated privileges, and terminates or deletes itself to eliminate forensic artifacts. Historically, Mudrop has been widely employed by cybercrime syndicates to deploy ransomware strains, banking trojans, and rootkits onto victim endpoints.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Dropper.Win32.Mudrop",
    "Trojan:Win32/Mudrop",
    "Trojan.Mudrop",
    "Win32/Mudrop"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Dropper.Win32.Mudrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mudrop is a trojan dropper designed to silently extract and execute secondary malicious payloads on Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mudrop hide secondary malware from scanners?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It embeds encrypted payload binaries within its PE resource sections and unpacks them only in memory or temporary folders."
      }
    },
    {
      "@type": "Question",
      "name": "What types of malware are dropped by Mudrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It has delivered ransomware strains, banking trojans, rootkits, and distributed denial-of-service bots."
      }
    },
    {
      "@type": "Question",
      "name": "How is Mudrop delivered to users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious torrent downloads, trojanized software keygens, and deceptive email attachments."
      }
    },
    {
      "@type": "Question",
      "name": "How do you disinfect a system from Mudrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a full system antimalware scan to purge dropped secondary binaries and clear temporary extraction folders."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1105",
    "T1059.003",
    "T1547.001",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal on Host: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint; if the Mudrop executed, it is highly probable that a secondary, severe payload is now active on the system.",
    "Capture a forensic memory image; if the Mudrop utilized process injection, the ultimate payload exists only in RAM and not on disk.",
    "Review EDR telemetry to identify exactly which child processes the Mudrop executable spawned or injected into before it terminated.",
    "Scan the file system for newly created, unsigned executables in temp directories that correlate with the execution time of the dropper."
  ],
  "what_to_avoid": [
    "Do not assume the threat is contained just because the initial Mudrop file was quarantined; the secondary payload may have already executed.",
    "Avoid rebooting the machine during triage if memory injection is suspected, as this destroys the evidence of the active payload."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Initial Access & Malware Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2010,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Torrent Archives",
    "Trojanized Keygens & Cracks",
    "Phishing Email Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Embedded Resource Payload Extraction",
    "Secondary Malware Staging",
    "Self-Deletion Forensics Countermeasure",
    "Elevated Execution Spawning",
    "Temporary Folder Masquerading"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Embedded Resource Binary"
    ],
    "network_signatures": [
      "Network traffic generated by the dropped secondary payloads (ransomware beacons or botnet C2)"
    ],
    "evasion_techniques": [
      "RC4 encryption of embedded PE binaries in resource directories",
      "Batch file self-deletion commands (cmd.exe /c del)",
      "Masquerading as standard installer setup executables"
    ],
    "indicators": {
      "file_paths": [
        "%Temp%\\mudrop_stage.exe",
        "%AppData%\\payload_bin.exe"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MudropPayload"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Trojan Dropper Framework"
    ],
    "variants": [
      "Mudrop.A",
      "Mudrop.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "12344556677889900aabbccddeeff11223344556677889900aabbccddeeff112",
      "234556677889900aabbccddeeff11223344556677889900aabbccddeeff11223"
    ],
    "delivery": [
      "torrent_crack_setup.exe",
      "driver_updater_bundle.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MudropPayload"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan-Dropper:Win32/Mudrop",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Dropper:Win32/Mudrop"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Dropper.Win32.Mudrop",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Dropper.Win32.Mudrop/"
    }
  ]
}