{
  "family": "pcclient",
  "sample_count": 31,
  "category": "rat",
  "description": "PcClient (classified across threat intelligence repositories under signatures including Backdoor:Win32/PcClient, Trojan:Win32/PcClient, and linked to the prolific Chinese open-source remote access trojan framework PcShare) is a landmark Windows remote access trojan and backdoor active since 2008. Widely adopted by diverse Chinese cyber espionage groups (including APT threat actors) and cybercriminal syndicates, PcClient provides extensive remote administration and surveillance capabilities. Once executed, PcClient installs persistence by creating a background service or registry Run key, connects to remote command-and-control servers using custom binary protocols, and provides operators with interactive command shell access, real-time desktop screen monitoring, keyboard logging, file uploading and downloading, process manipulation, and SOCKS proxy pivoting across compromised internal corporate networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/PcClient",
    "Trojan:Win32/PcClient",
    "Backdoor.Win32.PcClient",
    "Win32/PcClient",
    "PcShare RAT",
    "Backdoor.PcClient"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/PcClient (PcShare)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PcClient is a prominent modular Windows remote access trojan derived from the PcShare codebase, widely utilized in cyber espionage and crimeware operations."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance modules are included in PcClient?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PcClient includes live screen streaming, keystroke logging, microphone audio surveillance, file system browsing, and remote command shell execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does PcClient maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs itself as a Windows background service or registers autorun entries in the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How do threat actors use PcClient for lateral movement?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PcClient includes a built-in SOCKS proxy server module, enabling remote operators to pivot through the infected host into internal network subnets."
      }
    },
    {
      "@type": "Question",
      "name": "How can enterprise security teams detect PcClient?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for anomalous outbound TCP connections on non-standard ports, detect unauthorized service registrations, and inspect injected processes with EDR."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1090",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-Phishing Emails with Malicious Attachments",
    "Exploit Kit Drive-by Compromise",
    "Trojanized Chinese Software Portals"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2012",
    "Windows XP"
  ],
  "capabilities": [
    "Remote Interactive Command Shell",
    "Real-Time Desktop Screen Streaming",
    "Keystroke Logging & Audio Monitoring",
    "Internal Network SOCKS Proxy Pivoting",
    "Arbitrary File System Upload & Download"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi/VC++)",
      "Service DLL Stub"
    ],
    "network_signatures": [
      "Persistent TCP connections on non-standard ports (such as 2008, 8000, 9999) utilizing proprietary zlib-compressed binary packet formats",
      "Keepalive heartbeat packets carrying host architecture, active window title, and user privileges"
    ],
    "evasion_techniques": [
      "Registering as a legitimate-looking Windows service (such as Windows Audio Service Helper)",
      "Injecting backdoor DLL modules into svchost.exe or explorer.exe"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4",
      "26c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\PcClientSvc",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PcClient"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\pcclient.dll",
      "%AppData%\\PcClient\\client.exe",
      "%Temp%\\pc_stage.dat"
    ]
  },
  "defensive_measures": [
    "Inspect perimeter firewalls for unauthorized outbound binary communication sessions on non-standard ports",
    "Monitor service installation events (Windows Event ID 7045) for unverified service binaries",
    "Deploy endpoint detection and response (EDR) to identify reflective DLL injection into svchost.exe"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/PcClient",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/PcClient"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.PcClient",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [
      "PcShare RAT Framework"
    ],
    "variants": [
      "Backdoor:Win32/PcClient.A",
      "Backdoor:Win32/PcClient.B"
    ]
  },
  "motivation": "Cyber Espionage, Interactive Remote Administration & Network Pivoting",
  "sample_hashes": []
}