{
  "family": "runner",
  "sample_count": 18,
  "category": "trojan",
  "description": "Runner (classified in antimalware telemetry under signatures including Trojan:Win32/Runner, TrojanDownloader:Win32/Runner, and Trojan.Runner) is an obfuscated multi-stage Windows execution stager and payload loader. Distributed through malicious email spam attachments, cracked software packages, and exploit kit landings, Runner is engineered to bootstrap more complex malware families (such as infostealers, banking trojans, and ransomware). Upon initial execution, Runner conducts anti-sandbox environment checks (evaluating CPU core counts, virtual machine MAC address ranges, and memory sizes). It dynamically decodes embedded shellcode or downloads encrypted secondary payloads from attacker-controlled C2 servers via HTTP/HTTPS GET requests. Runner achieves persistence by creating scheduled tasks (schtasks /create) or writing autostart registry keys, executing secondary payloads through process injection (such as process hollowing or asynchronous procedure call injection) into legitimate Windows binaries like svchost.exe or explorer.exe.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Runner",
    "TrojanDownloader:Win32/Runner",
    "Win32/Runner",
    "Runner Loader",
    "Runner Stager"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Runner?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Runner is a multi-stage Windows trojan loader that downloads and executes secondary malware via process injection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Runner inject secondary malware into memory?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses process hollowing and QueueUserAPC injection to run decrypted shellcode inside legitimate processes like svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How is Runner delivered to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads through phishing emails with weaponized attachments, malicious torrents, and Trojanized cracks."
      }
    },
    {
      "@type": "Question",
      "name": "How does Runner evade automated malware analysis sandboxes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtual machine artifacts, examines screen resolution, and enforces sleep delays to defeat sandboxes."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended containment steps for Runner?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, capture memory dumps of injected processes, delete scheduled tasks, and block outbound C2 IPs."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055.012",
    "T1053.005",
    "T1105",
    "T1497"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Obfuscated Documents",
    "Software Crack Repacks and Keygens",
    "Exploit Kit Redirections"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Secondary Payload Downloading (HTTP/HTTPS)",
    "Process Hollowing & Thread Hijacking",
    "Virtual Machine & Sandbox Evasion",
    "Scheduled Task & Autostart Run Key Persistence",
    "Dynamic API Resolution via Memory Hashes"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "HTTP GET requests downloading RC4 or AES encrypted payload blobs",
      "Encrypted beacon traffic reporting victim system architecture to C2"
    ],
    "evasion_techniques": [
      "Executing secondary code in hollowed legitimate system processes",
      "Delay timers to outlast automated sandbox execution limits"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RunnerService"
    ],
    "file_paths": [
      "%AppData%\\Runner\\runner.exe",
      "%LocalAppData%\\Temp\\payload.bin"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection and response (EDR) rules alerting on process injection into svchost.exe",
    "Implement endpoint application whitelisting and restrict software execution from Temp and AppData directories",
    "Monitor network perimeters for unusual outbound HTTP GET requests retrieving encrypted executable blobs"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Runner",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Runner"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Runner",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Runner.A",
      "TrojanDownloader:Win32/Runner.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Secondary Payload Delivery & System Compromise",
  "sample_hashes": []
}