{
  "family": "perinet",
  "sample_count": 24,
  "category": "worm",
  "description": "Perinet (classified across threat intelligence repositories under signatures including Worm:Win32/Perinet, Backdoor:Win32/Perinet, and Trojan.Perinet) is a stealthy modular Windows network worm and remote access backdoor active since 2008. Designed for automated lateral movement across enterprise local area networks (LANs), Perinet scans internal subnets for accessible Server Message Block (SMB) file shares with weak or default administrative credentials. Upon gaining access to a remote host, Perinet copies itself into shared administrative folders (ADMIN$, C$) and leverages the Windows Task Scheduler or remote service creation (SVCCTL) to execute its payload. Once established on an endpoint, Perinet connects to remote command-and-control servers over HTTP/IRC, granting threat actors interactive remote command execution, keystroke logging, and internal network proxy capabilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Perinet",
    "Backdoor:Win32/Perinet",
    "Trojan.Perinet",
    "Win32/Perinet",
    "Perinet Worm"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/Perinet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perinet is a network worm and backdoor trojan that propagates across enterprise LANs via open SMB file shares and provides remote access."
      }
    },
    {
      "@type": "Question",
      "name": "How does Perinet spread across local networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans subnets for accessible SMB shares (ADMIN$, C$), brute-forces weak passwords, and drops executable payloads scheduled to run."
      }
    },
    {
      "@type": "Question",
      "name": "What backdoor capabilities are provided by Perinet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides interactive cmd shells, keystroke logging, file upload/download, and internal network proxy pivoting."
      }
    },
    {
      "@type": "Question",
      "name": "How does Perinet maintain persistence on infected machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers persistent Windows background services and creates startup registry entries in CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations defend against Perinet worm infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce strong SMB authentication passwords, disable SMBv1, isolate workstation subnets, and deploy behavioral EDR."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1021.002",
    "T1059.003",
    "T1056.001",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "SMB Network Share Propagation (Admin Shares)",
    "Spear-Phishing Emails with Attachments",
    "Compromised Software Downloads"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2012/2008",
    "Windows XP"
  ],
  "capabilities": [
    "Automated SMB Share Scanning & Lateral Movement",
    "Remote Interactive Command Shell Access",
    "Keystroke Logging & System Surveillance",
    "Internal Network Proxy Pivoting",
    "Service Installation & Registry Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C++)",
      "Service Wrapper Binary"
    ],
    "network_signatures": [
      "High-frequency internal subnet TCP port 445 (SMB) scanning and authentication attempts",
      "Outbound HTTP/IRC beacons to remote C2 IP addresses reporting host hostname, domain, and IP"
    ],
    "evasion_techniques": [
      "Disguising dropped executable names after legitimate Windows system services",
      "Throttling network scan frequency to blend with normal administrative traffic"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0",
      "6af3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\PerinetSvc",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Perinet"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\perinet.exe",
      "%Temp%\\smb_scan.dat"
    ]
  },
  "defensive_measures": [
    "Enforce strong password policies across all local administrator and service accounts",
    "Disable administrative share access (ADMIN$, C$) between client workstations via Group Policy",
    "Deploy network segmentation to restrict lateral SMB communications between non-server endpoints"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Worm:Win32/Perinet",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Perinet"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Worm.Win32.Perinet",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Worm:Win32/Perinet.A",
      "Backdoor:Win32/Perinet.B"
    ]
  },
  "motivation": "Lateral Network Movement, Unauthorized Remote Access & Cyber Espionage",
  "sample_hashes": []
}