{
  "family": "stubrc",
  "sample_count": 56,
  "category": "trojan_downloader",
  "description": "StubRC (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Dropper.MSIL.StubRC, Backdoor:Win32/Stubrc, and Trojan:MSIL/StubRC) is a malicious stub loader and dropper framework active since 2016. Often deployed as an initial access stage or payload decrypter for commodity RATs, botnets, and ransomware, StubRC embeds encrypted secondary binaries within its assembly resource sections (RCData / manifest resources). Upon launch, the stub extracts the embedded payload in memory, decrypts it using AES or RC4 routines, and performs process hollowing or RunPE injection into legitimate Windows binaries like svchost.exe or RegSvcs.exe to execute without touching disk.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Dropper.MSIL.StubRC",
    "Backdoor:Win32/Stubrc",
    "Trojan:MSIL/StubRC",
    "Dropper.MSIL.StubRC",
    "Win32/Stubrc"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Dropper.MSIL.StubRC?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "StubRC is a .NET malicious stub loader and dropper framework that decrypts and executes embedded payloads in memory."
      }
    },
    {
      "@type": "Question",
      "name": "How does StubRC hide secondary malware payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It stores encrypted payloads in compiled resource sections (RCData) and decrypts them dynamically during runtime."
      }
    },
    {
      "@type": "Question",
      "name": "What process injection techniques does StubRC utilize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It utilizes process hollowing (RunPE) to inject decrypted payloads into legitimate binaries like svchost.exe or RegSvcs.exe."
      }
    },
    {
      "@type": "Question",
      "name": "Why is StubRC classified both as a dropper and a backdoor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it drops full-featured backdoors and remote access trojans while sometimes retaining remote beaconing capability."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams defend against StubRC loaders?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce behavioral monitoring on process hollowing, enable AMSI for .NET script inspection, and restrict unverified binaries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.012",
    "T1027.002",
    "T1140",
    "T1105",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Phishing Attachments",
    "Weaponized ZIP & ISO Archives",
    "Trojanized Keygens & Utilities"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "RCData Resource Decryption",
    "In-Memory Process Hollowing (RunPE)",
    "Dynamic API Resolution via Reflection",
    "Secondary Malware Staging",
    "Evasion of Static File Scanners"
  ],
  "technical_analysis": {
    "file_types": [
      ".NET MSIL PE Executable",
      "Win32 PE Dropper"
    ],
    "network_signatures": [
      "Outbound HTTP/HTTPS requests fetching secondary decryption keys or staging payloads"
    ],
    "evasion_techniques": [
      "Process hollowing into trusted Windows utilities (RegAsm.exe, RegSvcs.exe)",
      "AES/RC4 encryption of stored PE binaries in resource tables"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "c3f8194ad9271649275819385920a19e48b3b42f",
      "891bb49f8b15df726489312bcf8194ad92716492"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StubRC"
    ],
    "file_paths": [
      "%AppData%\\StubRC\\stub.exe",
      "%Temp%\\payload.tmp"
    ]
  },
  "defensive_measures": [
    "Enable Antimalware Scan Interface (AMSI) to intercept in-memory .NET payload decryptions",
    "Deploy endpoint detection rules monitoring process hollowing and anomalous hollowed child processes",
    "Isolate untrusted attachments using automated sandboxing"
  ],
  "sources": [
    {
      "name": "Microsoft Security Intelligence - Trojan-Dropper:MSIL/StubRC",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Dropper:MSIL/StubRC"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan-Dropper.MSIL.StubRC.A",
      "Backdoor:Win32/Stubrc!rfn"
    ]
  },
  "motivation": "Initial Access Facilitation, Defense Evasion & Payload Delivery",
  "sample_hashes": []
}