{
  "family": "sinique",
  "sample_count": 0,
  "category": "trojan",
  "description": "Sinique (historically documented across threat intelligence archives as Sinique Trojan, Sinique 1.0, and Backdoor.Sinique) is an early 2000s remote access trojan (RAT) developed in Delphi. Designed as a modular client-server administration framework, Sinique allows remote unauthorized operators to control compromised Windows systems across TCP network sockets. Upon execution, the Sinique server binary installs itself into the Windows system directory, configures autostart persistence via the Windows registry Run keys, and listens for inbound connections or handshakes authenticated with a hardcoded pre-shared password. The trojan features comprehensive administrative commands including remote file system browsing, file upload and download, process termination, remote command shell execution, registry editing, and system reboot or power termination capabilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Sinique Trojan",
    "Backdoor.Sinique",
    "Trojan.Win32.Sinique",
    "Sinique 1.0",
    "Backdoor:Win32/Sinique"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Sinique backdoor trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sinique is an early Delphi-based remote access trojan that grants unauthorized remote control over compromised Windows endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sinique authenticate remote operators?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The server binary validates inbound client connections using a pre-configured hardcoded authentication password during TCP handshakes."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions can Sinique perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators can manipulate file systems, execute command line instructions, inspect and kill running processes, and manipulate registry hives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sinique survive system reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes executable startup pointers to HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run registry paths."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Sinique?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy host-based intrusion prevention, restrict unexpected listening TCP ports via firewalls, and use updated antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2002,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Classic Delphi Backdoor Era"
    ],
    "variants": [
      "Sinique 1.0",
      "Sinique 1.2",
      "Sinique.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1083",
    "T1105",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the compromised endpoint from the network to sever unauthorized remote access sessions.",
    "Kill the active Sinique server process using Task Manager or command line utilities.",
    "Remove the unauthorized registry run key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the Sinique server binary from the Windows System32 directory."
  ],
  "what_to_avoid": [
    "Do not execute software attachments received from unknown sources or P2P file shares.",
    "Avoid exposing Windows workstations directly to the public internet without firewall boundary protections."
  ],
  "iocs": {
    "file_hashes": [
      "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b",
      "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f"
    ],
    "delivery": [
      "Deceptive executable distribution via vintage IRC DCC file transfers and P2P networks",
      "Email attachments disguised as utility software or media archives"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SiniqueBackdoor",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SiniqueSys"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.Sinique",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Malware Museum Historical Backdoor Archive - Sinique",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}