{
  "family": "scrop",
  "sample_count": 53,
  "category": "trojan_downloader",
  "description": "Scrop (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Dropper:Win32/Scrop, Backdoor:Win32/Scrop, and Trojan.Win32.Scrop) is a stealthy Windows trojan dropper and initial access framework active since 2017. Propagated primarily through malicious email attachments, cracked software utilities, and drive-by downloads, Scrop serves as an evasion-focused loader designed to securely deploy secondary malware payloads such as banking trojans, information stealers, and remote access backdoors. Upon execution, Scrop establishes persistence via Windows Startup scripts (such as xcutes.exe.vbs) and scheduled tasks. To bypass host security controls and static antivirus signatures, Scrop leverages process injection into trusted native utilities like RegAsm.exe or svchost.exe, executing its decrypted payload in memory while establishing encrypted outbound C2 beacons.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Dropper:Win32/Scrop",
    "Backdoor:Win32/Scrop",
    "Trojan.Win32.Scrop",
    "Win32/Scrop",
    "Dropper.Win32.Scrop"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Dropper:Win32/Scrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Scrop is a stealthy Windows trojan dropper and loader designed to deliver secondary malicious payloads without detection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Scrop evade endpoint antivirus defenses?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects decrypted shellcode directly into legitimate Windows binaries like RegAsm.exe and svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How does Scrop establish persistence on the infected host?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It drops VBScript startup files (like xcutes.exe.vbs) and schedules recurring tasks to maintain execution after reboots."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically dropped by Scrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly delivers infostealers, banking trojans, keyloggers, and persistent remote access backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders remediate a Scrop infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan, terminate injected processes, and audit the Startup folder for malicious VBS scripts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1059.005",
    "T1547.001",
    "T1105",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Email Attachments",
    "Weaponized ZIP & RAR Archives",
    "Cracked Software & Patch Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Memory Process Injection (RegAsm.exe)",
    "VBScript Startup Persistence (xcutes.exe.vbs)",
    "Secondary Payload Decryption & Staging",
    "Encrypted Command-and-Control Beaconing",
    "Host Environment Sandboxing Detection"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "VBScript (.vbs)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded victim identifiers to C2 endpoints",
      "Outbound TLS handshakes retrieving secondary encrypted binaries"
    ],
    "evasion_techniques": [
      "Hollowing and code injection into legitimate .NET utilities (RegAsm.exe)",
      "Splitting payload execution between VBScript stagers and native executables"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "19385920a19e48b3b42f2b3e449a57291dc8f781",
      "b15df726489312bcf8194ad92716492758193859"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ScropLoader"
    ],
    "file_paths": [
      "%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\xcutes.exe.vbs",
      "%Temp%\\scrop_drop.bin"
    ]
  },
  "defensive_measures": [
    "Block unsigned scripts from executing in Windows Startup directories",
    "Enable EDR process behavioral monitoring on RegAsm.exe and RegSvcs.exe executions",
    "Restrict email gateway inbound attachments with executable or script extensions"
  ],
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Scrop",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.scrop"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan-Dropper:Win32/Scrop.A",
      "Backdoor:Win32/Scrop!rfn"
    ]
  },
  "motivation": "Initial Access Brokerage & Secondary Threat Delivery",
  "sample_hashes": []
}