{
  "family": "prjraptor",
  "sample_count": 0,
  "category": "trojan",
  "description": "PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retro Windows Trojan scene. Designed as a versatile client-server backdoor, PrjRAPTOR was built to provide full unauthorized administrative privileges over target workstations. Once deployed, the server executable opened a listening socket on a designated TCP port and registered an autostart hook in the Windows registry. Operators using the PrjRAPTOR control client could remotely browse and modify the local file system, upload and execute secondary binaries, terminate system processes, capture screen imagery, and execute interactive command prompt sessions. PrjRAPTOR also featured automated system reconnaissance capabilities, capturing environment variables, network interface details, and user account information upon connection.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Project Raptor",
    "PrjRaptor",
    "Backdoor.Win32.PrjRaptor",
    "Trojan.PrjRaptor",
    "Win32/PrjRaptor.RAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PrjRAPTOR?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PrjRAPTOR (Project Raptor) is a historical Remote Access Trojan from the early 2000s that allowed remote control over Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "What features did PrjRAPTOR provide to operators?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It offered interactive shell access, file management, process termination, screen capture, and system reconnaissance."
      }
    },
    {
      "@type": "Question",
      "name": "How was PrjRAPTOR deployed on targets?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was delivered via bundled software cracks, email attachments, and peer-to-peer file sharing networks."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to PrjRAPTOR campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering vintage trojan droppers have leveraged vulnerabilities including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can PrjRAPTOR be eradicated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the computer, terminate the listening process, delete dropped executable files, and clean startup registry entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1112",
    "T1083",
    "T1057",
    "T1082",
    "T1071.001",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1057",
      "name": "Process Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Block inbound connections to unexpected listening ports opened by the backdoor server.",
    "Kill the active PrjRAPTOR process and delete the binary located in system directories.",
    "Remove startup values under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Inspect system logs for unauthorized file modification or secondary tool execution."
  ],
  "what_to_avoid": [
    "Do not leave workstations connected to untrusted networks while backdoor services are actively listening.",
    "Avoid downloading unauthorized system tools from underground archival repositories."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.PrjRaptor",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.PrjRaptor/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.PrjRaptor",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/prjraptor"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "discovery"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2002,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Early Remote Access Frameworks"
    ],
    "variants": [
      "Project Raptor 1.0",
      "Project Raptor 2.0"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8",
      "1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Exploitation of shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PrjRaptorServer",
      "Startup folder shortcut placed under %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}