{
  "family": "nisloder",
  "sample_count": 103,
  "category": "loader",
  "description": "Nisloder (cataloged under Microsoft Defender signatures as TrojanDownloader:Win32/Nisloder and Trojan:Win32/Nisloder) is a lightweight modular trojan downloader and payload delivery stager active since 2014. Engineered as an initial access execution utility, Nisloder is deployed by cybercriminal syndicates to breach endpoints and stage high-value secondary payloads including ransomware droppers, banking trojans, and credential harvesters. The malware is commonly distributed via phishing emails disguised as commercial invoices, shipping receipts, or legal documentation with malicious macro attachments, as well as deceptive software cracks hosted on third-party download portals. Once executed, Nisloder deploys anti-analysis checks, dynamically unpacking its core shellcode into memory before injecting into native Windows system processes (such as svchost.exe or explorer.exe). It achieves persistence by registering hidden Windows Scheduled Tasks and autostart registry run entries, periodically issuing encrypted HTTP GET requests to operator-controlled command-and-control servers to download, decrypt, and launch secondary malicious modules.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Nisloder",
    "Trojan:Win32/Nisloder",
    "Nisloder Loader",
    "Win32/Nisloder"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the TrojanDownloader:Win32/Nisloder threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nisloder is a modular Windows trojan downloader designed to fetch and execute secondary malicious payloads from C2 servers."
      }
    },
    {
      "@type": "Question",
      "name": "How is Nisloder delivered to corporate workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious email attachments (macros, archives) and software cracks from unverified websites."
      }
    },
    {
      "@type": "Question",
      "name": "What evasion techniques does Nisloder implement?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses runtime memory unpacking, dynamic API resolution, and process injection into trusted native Windows binaries."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are deployed by Nisloder?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Nisloder to stage banking trojans, ransomware droppers, cryptocurrency miners, and remote access tools."
      }
    },
    {
      "@type": "Question",
      "name": "What steps are required to remediate a Nisloder compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, review network proxy logs to block C2 domains, perform memory triage, and clean persistence entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1055",
    "T1547.001",
    "T1566.001",
    "T1027",
    "T1053.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately from network segments to halt active C2 communication and secondary payload downloads.",
    "Audit Windows Task Scheduler and Registry Run keys to identify and eliminate scheduled autostart entries.",
    "Capture a volatile RAM image to extract injected downloader modules, C2 configuration strings, and downloaded payloads.",
    "Block identified C2 IP addresses and domain names at the corporate firewall and secure web gateway."
  ],
  "what_to_avoid": [
    "Do not close the investigation simply because the initial Nisloder file was removed; verify if secondary malware executed.",
    "Avoid relying solely on manual file deletion, as injected memory threads will quickly reinstall dropped binary components."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Enterprise Workstations",
    "Financial Services"
  ],
  "motivation": "Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Malware Distribution Networks"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "lineage": {
    "derived_from": [
      "Modular Windows Loaders"
    ],
    "variants": [
      "Nisloder.A",
      "Nisloder.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e",
      "2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f"
    ],
    "delivery": [
      "Spearphishing emails with malicious macro attachments",
      "Trojanized utility downloads from third-party sites"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NisloderUpdate",
      "Windows Scheduled Task launching dropped loader from %AppData%"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - TrojanDownloader:Win32/Nisloder",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Nisloder"
    },
    {
      "name": "Malwarebytes Threat Labs - Trojan Loaders and Stagers",
      "url": "https://www.malwarebytes.com/blog/threat-intelligence"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}