{
  "family": "rubinurd",
  "sample_count": 87,
  "category": "downloader",
  "description": "Rubinurd (cataloged by threat intelligence researchers and security vendors under identifiers including Trojan:Win32/Rubinurd, TrojanDownloader.Rubinurd, and Win32/Rubinurd) is a targeted Windows trojan downloader and staging agent active since 2011. Observed primarily in targeted cyber espionage and spearphishing campaigns targeting defense and governmental entities, Rubinurd was frequently delivered via weaponized Rich Text Format (RTF) and Word documents exploiting legacy memory corruption vulnerabilities (such as CVE-2010-3333 and CVE-2011-0611). Once executed, Rubinurd unpacks shellcode, unmaps target processes using NtUnmapViewOfSection, and injects clean staging code into host binaries. Rubinurd establishes encrypted beaconing to hardcoded command-and-control IP addresses and domains, serving as an initial access gateway to fetch, decrypt, and execute secondary surveillance backdoors—most notably the Taidoor and Simbot remote access trojans (RATs).",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Rubinurd",
    "TrojanDownloader:Win32/Rubinurd",
    "Win32/Rubinurd"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Rubinurd?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rubinurd is a targeted trojan downloader used in spearphishing campaigns to drop secondary backdoors like Taidoor."
      }
    },
    {
      "@type": "Question",
      "name": "Which vulnerabilities were exploited to distribute Rubinurd?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed via weaponized RTF documents exploiting Microsoft Office vulnerabilities CVE-2010-3333 and CVE-2011-0611."
      }
    },
    {
      "@type": "Question",
      "name": "Which secondary remote access trojan is commonly linked to Rubinurd?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat researchers have closely linked Rubinurd stagers to campaigns deploying the Taidoor and Simbot RATs."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rubinurd inject its payload into memory?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It performs process hollowing using NtUnmapViewOfSection to inject malicious code into legitimate processes."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken following a Rubinurd alert?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, block external C2 IP addresses at perimeter firewalls, patch Office vulnerabilities, and inspect memory for injected backdoors."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1203",
    "T1055.012",
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Rubinurd from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Rubinurd persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Rubinurd attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Rubinurd modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Rubinurd dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Targeted Cyber Espionage",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "threat_actor": "Taidoor Affiliated Groups",
  "delivery_mechanism": [
    "Spearphishing Emails with Weaponized RTF Documents",
    "Office Exploit Documents (CVE-2010-3333, CVE-2011-0611)",
    "Multi-stage Exploit Droppers"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Document Exploit Staging",
    "Process Hollowing (NtUnmapViewOfSection)",
    "Encrypted C2 Beaconing",
    "Secondary RAT Downloading (Taidoor)",
    "System Reconnaissance"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "RTF Document",
      "Shellcode Payload"
    ],
    "network_signatures": [
      "HTTP POST beacons with encrypted reconnaissance payloads to hardcoded C2 IPs",
      "Snort signatures matching Rubinurd C2 communication patterns"
    ],
    "evasion_techniques": [
      "Process hollowing into system processes",
      "Shellcode obfuscation inside document structures"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Rubinurd",
      "Startup folder executable placement"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Low",
    "scope": "Targeted espionage, secondary backdoor infection, intellectual property theft"
  },
  "lineage": {
    "derived_from": [
      "Taidoor Malware Ecosystem"
    ],
    "variants": [
      "Rubinurd.A",
      "Rubinurd.Simbot"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b",
      "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d"
    ],
    "delivery": [
      "statement_analysis.doc",
      "rubinurd_stager.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RubinurdClient",
      "%AppData%\\Rubinurd\\svchost.exe"
    ]
  },
  "sources": [
    {
      "name": "Contagio Malware Dump - Targeted Attack Rubinurd Analysis",
      "url": "http://contagiodump.blogspot.com"
    },
    {
      "name": "Snort Threat Rules - Trojan-Downloader.Win32.Rubinurd C2 Signatures",
      "url": "https://www.snort.org/rule_docs"
    }
  ]
}