{
  "family": "staser",
  "sample_count": 24,
  "category": "trojan",
  "description": "Staser (cataloged in antimalware telemetry under signatures including Trojan:Win32/Staser, TrojanDownloader:Win32/Staser, and Trojan.Staser) is an evasive multi-stage Windows trojan loader and information-harvesting implant active since 2015. Infiltrating endpoints primarily through phishing email attachments and malicious torrent downloads, Staser functions as an initial staging loader for secondary crimeware threats. Upon execution, Staser performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files—frequently modular banking trojans, cryptocurrency miners, and ransomware—saving and executing them from temporary directories or directly into memory via process hollowing.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Staser",
    "TrojanDownloader:Win32/Staser",
    "Trojan.Staser",
    "Win32/Staser",
    "Trojan:Win32/Staser.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Staser?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Staser is a multi-stage Windows trojan loader that collects system telemetry and stages secondary payloads like ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Staser evade security defenses?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtual machine artifacts, uses PEB hashing for dynamic API resolution, and hollows code into svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are deployed by Staser?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Staser to deliver banking trojans, password stealers, cryptocurrency miners, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Staser maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under CurrentVersion\\Run and registers background scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to a Staser detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, review process lineage for injected svchost.exe processes, and conduct full remediation of dropped payloads."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1105",
    "T1055",
    "T1082",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Attachments",
    "Trojanized Torrent Archives",
    "Drive-by Download Exploitation"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Binary Downloading & Staging",
    "Process Injection into svchost.exe",
    "Host Environmental Profiling & Telemetry",
    "Encrypted Command & Control Beaconing",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Encrypted Stager Payload (.dat)"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting serialized JSON telemetry to remote C2 endpoints",
      "HTTP GET requests fetching XOR-encrypted binary payloads disguised as PNG or GIF images"
    ],
    "evasion_techniques": [
      "Process hollowing into svchost.exe or explorer.exe to conceal malicious execution",
      "Dynamic API resolution via PEB hash lookups to foil static import detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9cb5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3",
      "adc6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StaserLoader",
      "HKCU\\Software\\Staser"
    ],
    "file_paths": [
      "%Temp%\\staser_agent.exe",
      "%AppData%\\Staser\\config.dat",
      "%LocalAppdata%\\Temp\\stage_drop.bin"
    ]
  },
  "defensive_measures": [
    "Enforce endpoint behavioral monitoring to detect process hollowing and memory manipulation in svchost.exe",
    "Filter web gateway traffic to block executable downloads from unclassified domains and newly created IPs",
    "Apply Software Restriction Policies preventing binary execution from user profile directories (%Temp%, %AppData%)"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Staser",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Staser"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Staser",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Staser.A",
      "Trojan:Win32/Staser.B"
    ]
  },
  "motivation": "Initial Access Facilitation & Secondary Malware Distribution",
  "sample_hashes": []
}