{
  "family": "redcap",
  "sample_count": 39,
  "category": "backdoor",
  "description": "Redcap (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/Redcap, Trojan:Win32/RedCap, and Backdoor.Redcap) is a persistent Windows remote access trojan (RAT) and backdoor active since 2017. Disseminated primarily through malicious email attachments, compromised website downloads, and cracked software packages, Redcap operates covertly to provide threat actors with interactive remote access. Upon execution, Redcap establishes persistence via Windows Registry Run keys and scheduled tasks, conducts system hardware and network reconnaissance, and initiates an encrypted outbound connection to attacker C2 servers. Redcap enables remote operators to execute arbitrary command-line instructions, upload and download files, and drop secondary malware payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Redcap",
    "Trojan:Win32/RedCap",
    "Backdoor.Redcap",
    "Win32/Redcap",
    "Backdoor:Win32/Redcap.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Redcap?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redcap is a persistent Windows remote access trojan and backdoor that grants attackers remote command execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Redcap infect target endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious email attachments, cracked software packages, and drive-by downloads from compromised websites."
      }
    },
    {
      "@type": "Question",
      "name": "What remote capabilities are provided by Redcap?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allows operators to run command prompt commands, upload/download files, capture system info, and stage secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Redcap maintain persistence on the host?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows Registry Run keys and creates scheduled tasks to restart automatically at system boot."
      }
    },
    {
      "@type": "Question",
      "name": "How can incident responders remove Redcap?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan, terminate rogue background processes, and reset compromised account passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Software Cracks & Keygens",
    "Drive-By Web Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Interactive Remote Shell Execution",
    "System Hardware & User Profiling",
    "Secondary Payload Downloading",
    "File Upload & Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP/HTTPS POST beacons transmitting victim telemetry to C2 servers",
      "Periodic keep-alive heartbeat handshakes on high ports"
    ],
    "evasion_techniques": [
      "Process injection into standard Windows background services",
      "Obfuscating internal API strings and dynamically resolving exports"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "449a57291dc8f781bb49f8b15df726489312bcf8",
      "cf8194ad9271649275819385920a19e48b3b42f2"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RedcapClient"
    ],
    "file_paths": [
      "%AppData%\\Redcap\\redcap.exe",
      "%Temp%\\redcap_cmd.tmp"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection rules for unauthorized processes opening raw network sockets",
    "Enforce outbound network filtering restricting direct outbound connections from workstations",
    "Audit Windows Registry Run keys and scheduled tasks regularly"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Redcap",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Redcap"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:Win32/Redcap.A",
      "Trojan:Win32/RedCap!mclg"
    ]
  },
  "motivation": "Cyber espionage, Remote Endpoint Control & Initial Access Brokerage",
  "sample_hashes": []
}