{
  "family": "netbus",
  "sample_count": 0,
  "category": "rat",
  "description": "NetBus is one of the earliest, most legendary, and influential Remote Access Trojans in personal computing history, originally created in March 1998 by Swedish computer programmer Carl-Fredrik Neikter. Written in Borland Delphi to run on Microsoft Windows 95, 98, and Windows NT, NetBus was initially marketed by its author as a harmless remote administration tool and prank utility. However, alongside the contemporaneous Back Orifice released by the Cult of the Dead Cow (cDc), NetBus ignited the modern era of remote administrative backdoors and network-borne malware exploitation.\n\nNetBus operated using an unauthenticated or password-protected client-server architecture: the server executable ('patch.exe') listened on TCP port 12345 (with port 12346 used for keylogger streaming). Once connected, the graphical client console gave attackers total control: opening and closing CD-ROM trays, swapping mouse buttons, taking screenshots, capturing real-time keystrokes, displaying popup messages, recording microphone audio, and executing arbitrary system commands. NetBus also played a landmark role in cyber law: in a famous 1999 Swedish criminal trial, a university professor was acquitted of possessing illegal material after forensic analysis demonstrated an unknown attacker had compromised his computer via NetBus and planted the files.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "NetBus",
    "Netbus Pro",
    "Patch.Netbus",
    "Backdoor.Netbus",
    "Trojan.NetBus"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is NetBus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetBus is a pioneering Remote Access Trojan created in 1998 by Carl-Fredrik Neikter that allowed users to remotely control Windows computers over TCP."
      }
    },
    {
      "@type": "Question",
      "name": "What ports did NetBus use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "By default, the NetBus server listened for inbound remote commands on TCP port 12345 and used port 12346 for raw keystroke logging."
      }
    },
    {
      "@type": "Question",
      "name": "What landmark legal precedent did NetBus establish?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In a 1999 Swedish criminal trial, a defendant was acquitted when computer forensics proved that an unknown attacker had planted illegal files on his computer using NetBus without his knowledge."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities did the NetBus client provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetBus allowed attackers to capture screens and keystrokes, eject CD-ROM trays, record microphone audio, view and edit files, and execute programs."
      }
    },
    {
      "@type": "Question",
      "name": "How is NetBus detected and removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Detect NetBus by monitoring for open listening ports on TCP 12345, inspecting startup Run registry keys for 'patch.exe', and deploying standard endpoint antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1125",
    "T1071.001",
    "T1547.001",
    "T1059.003"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1053",
      "name": "Technique",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Netbus binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Netbus installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "US Department of Justice CCIPS - Computer Crime Legal Precedents",
      "url": "https://www.justice.gov/criminal-ccips"
    },
    {
      "name": "CERT Coordination Center - NetBus Vulnerability Advisory",
      "url": "https://www.kb.cert.org/vuls/"
    },
    {
      "name": "Swedish Legal Archives - Landmark 1999 Trojan Defense Case",
      "url": "https://www.dn.se/"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 1998,
  "lineage": {
    "derived_from": [],
    "variants": [
      "netbus v1.53",
      "netbus v1.60",
      "netbus v1.70",
      "netbus pro v2.0"
    ]
  },
  "attribution": [
    {
      "actor": "Carl-Fredrik Neikter (Swedish Author, March 1998)",
      "confidence": "high",
      "basis": "Authored and publicly released by Swedish developer Carl-Fredrik Neikter in 1998. NetBus became the foundation for legal precedents regarding remote trojan defenses in computer crime trials in Europe and the United States.",
      "source": "https://www.justice.gov/criminal-ccips"
    }
  ],
  "exploited_cves": [],
  "c2_profile": {
    "protocols": [
      "TCP",
      "Plaintext Command Protocol",
      "Reverse Connection (NetBus 2.0 Pro)"
    ],
    "ports": [
      12345,
      12346,
      20034
    ],
    "infrastructure": "Direct inbound TCP listening socket on port 12345 (patch.exe), responding to plaintext ASCII command strings from the NetBus graphical client."
  },
  "iocs": {
    "file_hashes": [
      "4f2e96d2ff86e7a2df25b84c8a29a6cf7d853177699317585f6e80b27ef3e6ff",
      "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d"
    ],
    "delivery": [
      "IRC DCC file transfers and peer-to-peer file-sharing networks",
      "Executable binders bundling patch.exe inside games, pornographic media, or utility installers"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry pointing to patch.exe",
      "Modification of system.ini (shell=explorer.exe patch.exe) in Windows 95/98 environments"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}