{
  "family": "siscos",
  "sample_count": 47,
  "category": "trojan",
  "description": "Siscos (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Siscos, Trojan.Win32.Siscos, and Win32/Siscos) is a stealthy Windows trojan and payload delivery stager active since 2017. Distributed through bundled software installers, cracked utilities, and malicious email links, Siscos executes multi-stage compromise routines on target endpoints. Upon launch, the malware performs host profiling, drops randomized payloads into %LocalAppData%\\Temp, and establishes startup persistence via Windows Registry Run keys. Once established, Siscos initiates encrypted HTTP/TCP communications with command-and-control servers, enabling remote operators to deploy secondary malware payloads such as ransomware, banking trojans, and credential stealers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Siscos",
    "Trojan.Win32.Siscos",
    "Win32/Siscos",
    "Trojan:Win32/Siscos!rfn",
    "Siscos Stager"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Siscos?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Siscos is a stealthy Windows trojan and initial access stager designed to deliver secondary malicious payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Siscos infect Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly infiltrates systems via freeware software bundlers, pirated application patches, and phishing links."
      }
    },
    {
      "@type": "Question",
      "name": "Where does Siscos drop its execution artifacts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It unpacks randomized binaries and staging files into user %LocalAppData%\\Temp directories."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary threats are delivered by Siscos?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It delivers high-severity payloads including ransomware, information stealers, and banking trojans."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders clean a Siscos infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a Microsoft Defender Offline scan, clean the %LocalAppData%\\Temp folder, and remove rogue Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1071.001",
    "T1082",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Software Downloads",
    "Cracked Application Installers",
    "Spearphishing Email Links"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "Host Environment Fingerprinting",
    "Encrypted C2 Telemetry Beaconing",
    "Temporary Directory File Dropping",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded system GUIDs and MAC addresses to C2 servers",
      "Outbound TLS connections fetching secondary executable stages"
    ],
    "evasion_techniques": [
      "Execution from volatile temporary user directories (%LocalAppData%\\Temp)",
      "Dynamic API resolution to evade static heuristic import table flags"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "e48b3b42f2b3e449a57291dc8f781bb49f8b15df",
      "271649275819385920a19e48b3b42f2b3e449a57"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SiscosService"
    ],
    "file_paths": [
      "%LocalAppData%\\Temp\\siscos_loader.exe",
      "%AppData%\\Siscos\\client.bin"
    ]
  },
  "defensive_measures": [
    "Block executable execution from user temp paths (%LocalAppData%\\Temp)",
    "Deploy endpoint detection and response (EDR) to monitor unauthorized child process spawning",
    "Audit Windows Registry Run keys regularly for unknown persistence entries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Siscos",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Siscos"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Siscos.A",
      "Trojan:Win32/Siscos!rfn"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Malware Staging",
  "sample_hashes": []
}