{
  "family": "seed",
  "sample_count": 0,
  "category": "trojan",
  "description": "Seed (cataloged across security software as Backdoor:Win32/Seed, Trojan.Win32.Seed, and Backdoor.Seed) is a stealthy, lightweight Remote Access Trojan developed in early 2005 by the Brazilian malware author 'caesar2k' (who also created the well-known Nuclear RAT). Designed for low-profile command execution, Seed deliberately disguises its binary by copying itself to C:\\WINDOWS\\system32\\winlogo.exe, masquerading as the legitimate Windows winlogon.exe system binary. Once deployed, Seed listens for operator connections on custom TCP ports, establishing reverse command shells, file exfiltration, and arbitrary executable launching capabilities. Seed was commonly deployed via software cracks and malicious script attachments.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Seed",
    "Trojan.Win32.Seed",
    "Backdoor.Seed",
    "Win32/Seed.RAT",
    "Seed.Server"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Seed malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Seed is a lightweight Remote Access Trojan developed in early 2005 by caesar2k designed for stealthy remote command execution."
      }
    },
    {
      "@type": "Question",
      "name": "Where did Seed typically install itself?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly copied its binary to C:\\WINDOWS\\system32\\winlogo.exe to blend in with legitimate Windows files."
      }
    },
    {
      "@type": "Question",
      "name": "How did Seed achieve autostart persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It created a registry value named 'Seed' under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to its dropped binary."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Seed campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns distributing Seed droppers have leveraged shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How is Seed removed from an infected host?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminate the winlogo.exe process, delete the executable from System32, and delete the 'Seed' entry from the Run registry key."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1036.005",
    "T1112",
    "T1105",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Terminate suspicious processes named winlogo.exe running from C:\\Windows\\System32.",
    "Remove the 'Seed' value from HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the rogue binary located in the system directory and empty temporary caches.",
    "Inspect network logs for outbound TCP connections to unverified external IP addresses."
  ],
  "what_to_avoid": [
    "Do not mistake winlogo.exe for a legitimate Windows logon binary; official processes are typically winlogon.exe.",
    "Avoid running unverified executable downloads without static sandbox inspection."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Seed",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Seed/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Seed",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/seed"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2005,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Early C++ Reverse RAT Frameworks"
    ],
    "variants": [
      "Seed 1.0",
      "Seed 1.2"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5",
      "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a"
    ],
    "delivery": [
      "Software cracks and keygens distributed via peer-to-peer file sharing networks",
      "Malicious shortcut files exploiting CVE-2010-2568"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Seed",
      "C:\\WINDOWS\\system32\\winlogo.exe"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}