{
  "family": "pliskal",
  "sample_count": 23,
  "category": "trojan",
  "description": "Pliskal (tracked across enterprise antivirus research telemetry under designations including Trojan:Win32/Pliskal, Trojan:Win32/Pliskal.A, and TrojanDownloader:Win32/Pliskal) is a stealthy Windows trojan downloader and backdoor. First observed in targeted cybercrime campaigns, Pliskal establishes a foothold on victim machines through malicious email attachments disguised as administrative invoices or bundled inside repackaged pirated utility installers. Upon execution, Pliskal performs defensive evasion routines, checking for the presence of virtualized sandbox environments and analysis debuggers. It establishes persistence by writing Run registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Pliskal gathers basic host reconnaissance data—including machine hostname, Windows build version, local IP address, and installed security software—and transmits this telemetry to remote command-and-control (C2) servers via HTTP/HTTPS POST requests. In return, the C2 server issues instructions to download, stage, and execute secondary malicious payloads, including credential stealers, keyloggers, and ransomware, using CreateProcessW and ShellExecuteW APIs.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Pliskal",
    "Trojan:Win32/Pliskal.A",
    "TrojanDownloader:Win32/Pliskal",
    "Win32/Pliskal",
    "Backdoor.Win32.Pliskal"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Pliskal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pliskal is a Windows trojan downloader and backdoor designed to establish persistent access and deploy secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pliskal achieve persistence on infected hosts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows Run registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to trigger automatic execution at user logon."
      }
    },
    {
      "@type": "Question",
      "name": "What network protocols does Pliskal use for C2 communications?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pliskal uses standard HTTP and HTTPS POST requests with encoded payloads to communicate with remote command-and-control servers."
      }
    },
    {
      "@type": "Question",
      "name": "How is Pliskal delivered to target systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through weaponized spearphishing email attachments, malicious downloads, and Trojanized software packages."
      }
    },
    {
      "@type": "Question",
      "name": "What steps are required to eradicate a Pliskal infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate suspicious parent processes, delete unauthorized Run registry keys, remove staged binaries from %APPDATA%, and scan for secondary payloads."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1082",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Intelligence - Pliskal",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Pliskal"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Pliskal",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.pliskal"
    },
    {
      "name": "Malwarebytes Threat Intelligence Database",
      "url": "https://www.malwarebytes.com/blog/threat-intelligence"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the local network and terminate active internet connections.",
    "Kill unauthorized processes executing from %APPDATA% or %TEMP% directories.",
    "Inspect and remove startup values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block outbound C2 IP addresses and domains at the enterprise firewall and DNS resolvers.",
    "Perform a complete endpoint security scan to identify and neutralize secondary payloads dropped by Pliskal."
  ],
  "what_to_avoid": [
    "Do not allow the infected system to maintain outbound internet access while investigating.",
    "Do not assume removing the initial dropper executable cleans the machine, as secondary payloads may have been installed."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Financial Services",
    "Commercial Enterprises"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Groups"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Crime & Secondary Malware Distribution",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}