{
  "family": "sixxpack",
  "sample_count": 21,
  "category": "trojan",
  "description": "Sixxpack (classified across endpoint detection telemetry under designations including Trojan:Win32/Sixxpack, Trojan:Win32/Sixxpack.A, and VirTool:Win32/Sixxpack) is an obfuscated multi-stage Windows trojan loader and crypter framework. Designed to evade behavioral monitoring and signature-based antivirus solutions, Sixxpack is distributed via weaponized email attachments, software cracking archives, and malicious download aggregators. Upon initial execution, Sixxpack executes anti-sandbox and debugger evasion routines, resolving API calls dynamically via memory hashes (API hashing) to defeat static analysis. It establishes autostart persistence by configuring Run registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Sixxpack decrypts an embedded payload in memory and injects the malicious code into legitimate Windows system processes (such as svchost.exe or explorer.exe) using process hollowing or reflective DLL loading, establishing an encrypted C2 channel to execute secondary commands.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Sixxpack",
    "Trojan:Win32/Sixxpack.A",
    "VirTool:Win32/Sixxpack",
    "Win32/Sixxpack",
    "Trojan.Sixxpack"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Sixxpack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sixxpack is an obfuscated trojan loader and crypter framework that injects malicious payloads into legitimate Windows processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sixxpack evade detection by antivirus software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses dynamic API hashing, anti-debugging routines, payload encryption, and memory injection into processes like svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sixxpack maintain persistence across system reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to launch at user logon."
      }
    },
    {
      "@type": "Question",
      "name": "How is Sixxpack delivered to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious email attachments, Trojanized freeware repacks, and software crack archives."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended containment steps for Sixxpack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, capture memory dumps of hollowed processes, remove Run registry entries, and block external C2 communications."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1027",
    "T1547.001",
    "T1071.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Sixxpack",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Sixxpack"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Sixxpack",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.sixxpack"
    },
    {
      "name": "VirusTotal Threat Intelligence - Sixxpack Telemetry",
      "url": "https://www.virustotal.com/gui/home/upload"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the affected workstation from internal network segments immediately.",
    "Inspect running instances of svchost.exe and explorer.exe for hollowed memory regions.",
    "Remove startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to Sixxpack.",
    "Block outbound C2 IP addresses and domains across perimeter firewalls and DNS resolvers.",
    "Perform an enterprise endpoint detection and response (EDR) scan to eliminate secondary payloads."
  ],
  "what_to_avoid": [
    "Do not allow the infected system to communicate outbound to external networks during triage.",
    "Do not assume simple file deletion terminates hollowed background processes in memory."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Financial Services",
    "Technology"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Operators"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Evasive Payload Delivery & Secondary Malware Staging",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}