{
  "family": "slugin",
  "sample_count": 31,
  "category": "trojan_downloader",
  "description": "Slugin (documented across security intelligence catalogs under signatures including TrojanDownloader:Win32/Slugin, Trojan:Win32/Slugin, and Trojan.Slugin) is a stealthy modular trojan downloader and plugin injector active since 2015. Primarily distributed through infected freeware installers, trojanized utility bundles, and spear-phishing attachments, Slugin operates as a persistent staging vector for secondary crimeware and espionage payloads. Upon launching, Slugin performs anti-analysis checks, evades virtual machine environments, and installs persistence through Windows Registry Run keys or Task Scheduler entries. It contacts threat actor command-and-control servers using encrypted HTTP/HTTPS traffic to report host hardware information and system telemetry. Slugin dynamically requests, downloads, and loads modular binary plugins—such as keystroke loggers, credential stealers, and proxy forwarders—executing them directly in system memory via reflective DLL injection or process hollowing into legitimate Windows binaries.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Slugin",
    "Trojan:Win32/Slugin",
    "Trojan.Slugin",
    "Win32/Slugin",
    "TrojanDownloader:Win32/Slugin.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Slugin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Slugin is a modular Windows trojan downloader that retrieves and injects secondary malicious plugins into memory on compromised systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Slugin execute downloaded plugins?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes dynamic binary modules directly in memory using reflective DLL injection and process hollowing into trusted Windows processes."
      }
    },
    {
      "@type": "Question",
      "name": "What types of plugins does Slugin deploy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors deploy keystroke loggers, credential stealers, network proxy redirectors, and secondary ransomware payloads via Slugin."
      }
    },
    {
      "@type": "Question",
      "name": "How does Slugin achieve persistence on infected hosts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers scheduled tasks and writes autostart entries under the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators detect Slugin infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for anomalous memory injection events into svchost.exe or explorer.exe, and inspect outbound encrypted HTTP connections to unclassified domains."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1055.001",
    "T1055.012",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Freeware Utilities",
    "Spear-Phishing Emails with Attachments",
    "Drive-by Download Exploitation"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Modular Dynamic Plugin Downloading",
    "Reflective DLL Memory Injection",
    "Process Hollowing into Trusted Binaries",
    "Host Environmental Fingerprinting",
    "Encrypted Command & Control Telemetry"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL Plugin)"
    ],
    "network_signatures": [
      "Encrypted HTTP/HTTPS POST beacons transmitting system profiling metrics to remote C2 endpoints",
      "Outbound HTTP GET requests fetching XOR-encrypted plugin binaries disguised as image or archive files"
    ],
    "evasion_techniques": [
      "Reflective memory injection avoiding writing malicious DLL files to disk",
      "Checking for hypervisor identifiers and sandboxed execution environments"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9db4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "aeb5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SluginLoader",
      "HKCU\\Software\\Slugin"
    ],
    "file_paths": [
      "%Temp%\\slugin_svc.exe",
      "%AppData%\\Slugin\\loader.dat",
      "%LocalAppdata%\\Temp\\plugin_cache.bin"
    ]
  },
  "defensive_measures": [
    "Deploy Endpoint Detection and Response (EDR) solutions configured to detect reflective memory injection and process hollowing",
    "Restrict executable and DLL loading from temporary user directories (%Temp%, %AppData%)",
    "Block outbound network traffic to unclassified or newly registered C2 domains"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Slugin",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Slugin"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Slugin",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Slugin.A",
      "TrojanDownloader:Win32/Slugin.B"
    ]
  },
  "motivation": "Initial Staging, Modular Malware Delivery & System Exploitation",
  "sample_hashes": []
}