{
  "family": "shodi",
  "sample_count": 76,
  "category": "backdoor",
  "description": "Shodi (cataloged across security vendors under detections including Backdoor:Win32/Shodi, Trojan:Win32/Shodi, and BackDoor.Shohdi) is a classic Windows remote access trojan and backdoor active since 2008. Designed to establish persistent, covert remote control over compromised systems, Shodi opens an unauthenticated listening backdoor on dedicated network ports (most commonly TCP port 7352). This allows remote attackers to connect directly to the infected host, execute arbitrary command shell instructions, navigate the local filesystem, upload and download files, and terminate running processes. In addition, Shodi modifies system registry settings under Windows CurrentVersion\\Run to ensure autostart across reboots and has been observed acting as a secondary staging platform for dropping ransomware precursors, keyloggers, and network scanning utilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Shodi",
    "Trojan:Win32/Shodi",
    "BackDoor.Shohdi"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Shodi?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shodi is a classic remote access backdoor that opens listening ports to allow attackers remote control over a PC."
      }
    },
    {
      "@type": "Question",
      "name": "Which network port is opened as a backdoor by Shodi?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shodi commonly opens a listening backdoor on TCP port 7352 for unauthenticated remote administration."
      }
    },
    {
      "@type": "Question",
      "name": "What actions can an attacker execute through the Shodi backdoor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They can execute terminal commands, upload and download sensitive files, modify the registry, and stage secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Shodi infect user workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious phishing attachments, pirated software downloads, and drive-by web exploits."
      }
    },
    {
      "@type": "Question",
      "name": "How should administrators remediate a Shodi infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the computer, close listening ports at the firewall, run a full offline antimalware scan, and change credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1082",
    "T1057",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Shodi frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Pirated Software & Keygens",
    "Drive-by Downloads"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "TCP Port 7352 Listening Backdoor",
    "Remote Shell Command Execution",
    "Bidirectional File Transfer",
    "Process Termination",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Inbound listening connection on TCP port 7352",
      "Plaintext or XOR-encoded command shell traffic"
    ],
    "evasion_techniques": [
      "Process injection into svchost.exe",
      "Masquerading as Windows system utilities"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShodiBackdoor",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemTrayService"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Total host control, listening backdoor exposure, unauthorized command shell execution"
  },
  "lineage": {
    "derived_from": [
      "Classic Win32 Remote Access Trojans"
    ],
    "variants": [
      "Shodi.A",
      "Shohdi.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f",
      "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b"
    ],
    "delivery": [
      "patch_installer.exe",
      "shodi_service.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShodiSvc",
      "%SystemRoot%\\System32\\shodi_backdoor.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Shodi",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shodi"
    },
    {
      "name": "Dr.Web Virus Description - BackDoor.Shohdi",
      "url": "https://vms.drweb.com"
    }
  ]
}