{
  "family": "omaneat",
  "sample_count": 66,
  "category": "trojan",
  "description": "Omaneat (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Omaneat, Spyware:Win32/Omaneat!pz, and TrojanSpy:MSIL/Omaneat) is a stealthy Windows spyware trojan active since 2015. Distributed primarily through spearphishing emails with weaponized attachments and deceptive download portals, Omaneat specializes in host surveillance and system reconnaissance. Upon execution, the malware injects malicious code into legitimate Windows background processes to mask its memory presence. Omaneat harvests comprehensive endpoint intelligence, including operating system specifications, hardware identifiers, lists of installed security software, and web browsing history. It maintains persistence through registry modifications under Windows CurrentVersion\\Run and transmits encrypted host profiles back to attacker-controlled command-and-control servers over HTTP.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Omaneat",
    "Spyware:Win32/Omaneat!pz",
    "TrojanSpy:MSIL/Omaneat",
    "Win32/Omaneat"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Omaneat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Omaneat is a Windows spyware trojan that injects into system processes and harvests host intelligence."
      }
    },
    {
      "@type": "Question",
      "name": "What information does Omaneat steal from compromised PCs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It steals system hardware configurations, OS build details, installed antivirus lists, and browsing history."
      }
    },
    {
      "@type": "Question",
      "name": "How does Omaneat evade detection on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects its malicious threads into legitimate running Windows background processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Omaneat maintain autostart persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart entries within the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How do you disinfect a system from Omaneat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run an antimalware scan with Microsoft Defender, delete suspicious startup keys, and change account passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1056.001",
    "T1555.003",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Omaneat payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Omaneat persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Information Gathering & Surveillance",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Deceptive Download Portals",
    "Pirated Software Packages"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Process Memory Injection",
    "System Hardware & Antivirus Profiling",
    "Browser History Harvesting",
    "Encrypted HTTP Telemetry Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      ".NET Framework Assembly",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST requests transmitting system profile data to remote C2 servers",
      "Periodic beacon traffic disguised as legitimate web browsing requests"
    ],
    "evasion_techniques": [
      "Injecting execution threads into legitimate system binaries like svchost.exe",
      "Obfuscating payload strings and API calls"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\OmaneatClient",
      "%AppData%\\Omaneat\\omaneat.exe"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Comprehensive system intelligence exfiltration, browser surveillance, persistent stealth presence"
  },
  "lineage": {
    "derived_from": [
      "Win32 Spyware & Reconnaissance Architectures"
    ],
    "variants": [
      "Omaneat.A",
      "Omaneat.PZ"
    ]
  },
  "iocs": {
    "file_hashes": [
      "5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c",
      "6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d"
    ],
    "delivery": [
      "invoice_doc.exe",
      "omaneat_patch.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\OmaneatService",
      "%AppData%\\Omaneat\\omaneat_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Omaneat",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Omaneat"
    },
    {
      "name": "EnigmaSoft Threat Research - Omaneat Spyware Profile",
      "url": "https://www.enigmasoftware.com"
    }
  ]
}