{
  "family": "murofet",
  "sample_count": 53,
  "category": "trojan",
  "description": "Murofet (cataloged across security vendors and threat intelligence databases under detections including Trojan:Win32/Murofet, TrojanDownloader:Win32/Murofet, and W32.Murofet) is a sophisticated trojan downloader and botnet infrastructure component that emerged in 2010. Developed to provide resilient initial access and payload distribution for organized cybercrime syndicates, Murofet was one of the earliest malware families to implement advanced Domain Generation Algorithms (DGA) seeded by daily date calculations and hardcoded mathematical constants, generating hundreds of pseudorandom domains across various TLDs (.com, .net, .biz, .info) to evade DNS blocklists and sinkholing efforts. Murofet injects malicious code into legitimate Windows processes such as explorer.exe and svchost.exe, queries Twitter and external blogging accounts for fallback backup C2 endpoints, and downloads high-impact secondary payloads—including ZeuS banking trojans and rootkits—while terminating antivirus monitoring routines.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Murofet",
    "TrojanDownloader:Win32/Murofet",
    "W32.Murofet",
    "Trojan-Downloader.Win32.Murofet",
    "Win32/Murofet"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Murofet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Murofet is a sophisticated trojan downloader that utilizes domain generation algorithms (DGA) to deliver secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Murofet ensure command-and-control resilience?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It dynamically computes hundreds of algorithmic domain names daily and queries social media accounts for backup C2 feeds."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically dropped by Murofet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Murofet has historically distributed ZeuS banking trojans, spam bots, and kernel rootkits."
      }
    },
    {
      "@type": "Question",
      "name": "How does Murofet execute code covertly on Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses process injection to execute in the memory space of explorer.exe and svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How can network defenders counter Murofet infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy DNS monitoring capable of flagging algorithmic domain requests, isolate infected endpoints, and run deep AV scans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1568.002",
    "T1055",
    "T1105",
    "T1547.001",
    "T1102.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Murofet from successfully resolving its DGA domains and downloading the Zeus banking trojan.",
    "Analyze DNS logs for high volumes of NXDOMAIN responses, which indicate the DGA is actively searching for the C2 infrastructure.",
    "Audit the Windows Registry Run keys to identify and remove the Murofet persistence mechanisms.",
    "Assume secondary payloads have already been downloaded; a complete, clean rebuild of the operating system is the most secure remediation."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Murofet dropper was quarantined; always verify if the Zeus payload was downloaded.",
    "Avoid relying on static IP blacklists for defense; Murofet's DGA renders traditional blocking ineffective."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Initial Access & Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2010,
  "threat_actor": null,
  "delivery_mechanism": [
    "Exploit Kits & Drive-By Downloads",
    "Trojanized Software Bundles",
    "Malicious Email Attachments"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP",
    "Windows Server 2008"
  ],
  "capabilities": [
    "Algorithmic Domain Generation (DGA)",
    "Process Injection into explorer.exe",
    "Dead Drop Resolver Backup C2",
    "Secondary Malware Payload Dropping",
    "Security Process Termination"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "High-volume NXDOMAIN DNS requests querying pseudo-randomly generated domain strings",
      "Encrypted HTTP POST beacons reporting machine hardware hashes"
    ],
    "evasion_techniques": [
      "Process hollowing and thread injection into svchost.exe",
      "Time-seeded DGA rendering static IP/domain blocklists obsolete",
      "Bypassing host firewalls via trusted system processes"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\System32\\murofet_stub.dll",
        "%AppData%\\murofet.exe"
      ],
      "registry_keys": [
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MurofetDownloader"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Murofet Botnet Infrastructure"
    ],
    "variants": [
      "Murofet.A",
      "Murofet.DGA"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3c4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef01234",
      "4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef012345"
    ],
    "delivery": [
      "flash_player_update_setup.exe",
      "document_invoice_scan.zip"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MurofetDownloader"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Murofet",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Murofet"
    },
    {
      "name": "Symantec Threat Analysis - W32.Murofet Security Report",
      "url": "https://www.broadcom.com/support/security-center"
    }
  ]
}