{
  "family": "schoolbus",
  "sample_count": 0,
  "category": "trojan",
  "description": "Schoolbus (cataloged across security software as Backdoor:Win32/Schoolbus, Trojan.Win32.Schoolbus, and Backdoor.Schoolbus) is a classic early 2000s Remote Access Trojan created in Microsoft Visual Basic. Developed during the retro Windows backdoor era, Schoolbus operated a dedicated client-server architecture over custom TCP port 2001 (and configurable high-range ports), providing remote attackers with full interactive control over infected workstations. Capabilities included keystroke logging, desktop screen capture, interactive remote shell execution, system rebooting, and unauthorized file system browsing. Schoolbus was commonly distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized gaming cracks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Schoolbus",
    "Trojan.Win32.Schoolbus",
    "Backdoor.Schoolbus",
    "Win32/Schoolbus.RAT",
    "Schoolbus.Server"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Schoolbus backdoor trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Schoolbus is a classic Visual Basic Remote Access Trojan developed in the early 2000s that operates over TCP port 2001."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control features did Schoolbus include?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It included screen capture, keystroke logging, file upload/download, remote command shell, and system rebooting."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors propagate Schoolbus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized gaming utilities."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Schoolbus campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering vintage trojan droppers have leveraged vulnerabilities including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Schoolbus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block port 2001, deploy endpoint antimalware protection, and monitor autostart registry entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105",
    "T1056.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Block inbound network connections to TCP port 2001 on perimeter firewalls.",
    "Kill active Schoolbus server processes running from %SYSTEM32% or %TEMP% directories.",
    "Delete persistence values under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Conduct a full antimalware disk scan to eliminate secondary dropped dropper stubs."
  ],
  "what_to_avoid": [
    "Do not execute software downloaded from unverified peer-to-peer file sharing repositories or forum links.",
    "Avoid operating compromised machines without performing full forensic memory triage."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Schoolbus",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Schoolbus/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Schoolbus",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/schoolbus"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "discovery"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2001,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Visual Basic RAT Frameworks"
    ],
    "variants": [
      "Schoolbus v1.0",
      "Schoolbus v1.2",
      "Schoolbus Pro"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
      "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "IRC DCC file transfer lures and malicious download links"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SchoolbusServer",
      "Startup folder shortcut placed under %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}