{
  "family": "pidgeon",
  "sample_count": 23,
  "category": "trojan_downloader",
  "description": "Pidgeon (identified across endpoint security databases under signatures including TrojanDownloader:Win32/Pidgeon, Trojan:Win32/Pidgeon, and Trojan.Pidgeon) is an evasive multi-stage Windows trojan downloader active since 2016. Infiltrating endpoints primarily through phishing email attachments and malicious software downloads, Pidgeon functions as an initial staging loader for secondary crimeware threats. Upon execution, Pidgeon performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files—frequently modular banking trojans, cryptocurrency miners, and ransomware—saving and executing them from temporary directories or directly into memory via process hollowing.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Pidgeon",
    "Trojan:Win32/Pidgeon",
    "Trojan.Pidgeon",
    "Win32/Pidgeon",
    "TrojanDownloader:Win32/Pidgeon.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Pidgeon?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pidgeon is a Windows trojan downloader that fingerprints systems and downloads secondary malware payloads like ransomware and miners."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pidgeon evade detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtual machine artifacts, uses PEB hashing for dynamic API resolution, and hollows code into svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are deployed by Pidgeon?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Pidgeon to drop modular banking trojans, cryptocurrency stealers, keyloggers, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pidgeon establish persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries under CurrentVersion\\Run and registers scheduled background tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators defend against Pidgeon downloaders?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Filter email attachments for malicious macros, restrict script execution in %Temp%, and deploy modern behavioral EDR."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1497.001",
    "T1055",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Office Attachments",
    "Exploit Kit Redirections",
    "Trojanized Freeware Downloaders"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Secondary Payload Downloading",
    "Process Injection into svchost.exe",
    "Hypervisor & Sandbox Environment Checks",
    "Host Telemetry Gathering & Beaconing",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP/HTTPS POST beacons transmitting host hardware identifiers and user privileges",
      "Outbound HTTP GET requests fetching XOR-encrypted secondary binary blobs disguised as font or image files"
    ],
    "evasion_techniques": [
      "Dynamic API resolution through PEB hash lookups to conceal API imports from static analysis",
      "Checking for hypervisor registry artifacts and terminating execution if detected"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7ba4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2",
      "8cb5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PidgeonLoader",
      "HKCU\\Software\\Pidgeon"
    ],
    "file_paths": [
      "%Temp%\\pidgeon.exe",
      "%AppData%\\Pidgeon\\stage.dat",
      "%LocalAppdata%\\Temp\\dl_stage.bin"
    ]
  },
  "defensive_measures": [
    "Implement Software Restriction Policies to block executable execution from %Temp% and %AppData%",
    "Deploy secure email gateways that quarantine macro-enabled office documents from untrusted external senders",
    "Configure EDR alerts for rapid downloader execution followed by code injection into system processes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Pidgeon",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Pidgeon"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Pidgeon",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Pidgeon.A",
      "TrojanDownloader:Win32/Pidgeon.B"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Malware Delivery",
  "sample_hashes": []
}