{
  "family": "subseven",
  "sample_count": 0,
  "category": "trojan",
  "description": "SubSeven (also widely known as Sub7, Backdoor.SubSeven, and Sub7 Gold) is one of the most culturally iconic and technologically influential Remote Access Trojans in computing history. Created in 1999 by a hacker using the pseudonym 'Mobman', SubSeven served as the direct successor to earlier Windows backdoors like NetBus and Back Orifice, offering a graphical client interface and advanced remote administration capabilities. Written in Delphi, SubSeven allows unauthorized operators to connect to infected Windows 9x, NT, and 2000 machines over TCP (typically listening on default ports 27374 or 1243). The backdoor provided a vast array of surveillance and administrative features, including real-time keystroke logging, webcam streaming, audio recording, screen capture, file management, registry editing, CD-ROM tray manipulation, port redirection, and denial-of-service packet flooding. SubSeven also featured an automated notification engine, alerting the attacker via ICQ, IRC, or email whenever an infected machine connected to the internet.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Sub7",
    "Backdoor.SubSeven",
    "Sub7 Gold",
    "Trojan.SubSeven",
    "Backdoor:Win32/SubSeven",
    "Sub7 2.2"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the SubSeven (Sub7) trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SubSeven is an iconic late-1990s remote access trojan created by 'Mobman' that provided comprehensive remote control and surveillance over Windows computers."
      }
    },
    {
      "@type": "Question",
      "name": "What default network ports does SubSeven use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The classic SubSeven server listens on TCP port 27374 by default, though attackers could configure alternate ports such as 1243 or custom ports."
      }
    },
    {
      "@type": "Question",
      "name": "How did SubSeven alert attackers when a victim came online?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SubSeven featured an automated notification module that sent ICQ messages, IRC channel notices, or emails containing the victim's current IP address."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities did the SubSeven client provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It included keylogging, webcam and microphone capture, screen viewing, file transfer, registry editing, and hardware pranks like opening CD trays."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be protected against SubSeven?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block inbound connections on ports 27374 and 1243 at network firewalls, monitor registry autostart locations, and deploy standard antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 1999,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Win32 Backdoor Era"
    ],
    "variants": [
      "Sub7 2.1",
      "Sub7 2.2",
      "Sub7 Gold",
      "Sub7 Legends"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1113",
    "T1125",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the network to terminate active attacker sessions on port 27374.",
    "Kill the server process (frequently named server.exe, nodll.exe, or hidden under legitimate system names).",
    "Clean malicious entries from the Windows registry Run keys and win.ini/system.ini configuration files.",
    "Delete the server binary from the Windows System directory and perform a full antivirus scan."
  ],
  "what_to_avoid": [
    "Do not execute software files sent over IRC, instant messaging services, or unverified download sites.",
    "Avoid exposing Windows workstations to the public internet without router NAT and firewall protection."
  ],
  "iocs": {
    "file_hashes": [
      "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a",
      "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d"
    ],
    "delivery": [
      "Vintage IRC DCC file transfers, ICQ messaging, and pirated software game cracks",
      "Deceptive executable binders combining the Sub7 server with legitimate games or utilities"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SubSevenServer",
      "win.ini [windows] run=server.exe"
    ]
  },
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.SubSeven",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.subseven"
    },
    {
      "name": "Broadcom Symantec Security Response - Backdoor.SubSeven",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}