{
  "family": "subti",
  "sample_count": 35,
  "category": "trojan_downloader",
  "description": "Subti (classified across threat telemetry and antivirus databases as TrojanDownloader:Win32/Subti, Trojan:Win32/Subti, and Win32/Subti) is an evasive multi-stage Windows trojan downloader active since 2016. Often distributed through spam emails containing password-protected archive files or deceptive download wrappers on file-sharing sites, Subti specializes in staging secondary crimeware threats onto compromised endpoints. Upon execution, Subti conducts environmental anti-sandbox checks (evaluating system uptime, cursor coordinates, and screen resolution) before establishing outbound HTTP/HTTPS connections to attacker-controlled distribution nodes. It downloads encrypted secondary binary blobs, decrypts them in memory using multi-byte XOR keys, and drops or injects payloads—frequently cryptocurrency miners, modular infostealers, or ransomware loaders—directly into Windows user processes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Subti",
    "Trojan:Win32/Subti",
    "Trojan.Subti",
    "Win32/Subti",
    "TrojanDownloader:Win32/Subti.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Subti?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Subti is a stealthy Windows trojan downloader designed to bypass sandbox analysis and download secondary malware payloads onto infected hosts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Subti detect virtualized sandboxes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It measures elapsed system uptime, verifies human mouse cursor movements across consecutive API queries, and checks screen resolutions."
      }
    },
    {
      "@type": "Question",
      "name": "What payloads are typically downloaded by Subti?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators utilize Subti to deliver cryptocurrency miners, modular infostealers, banking trojans, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Subti conceal downloaded binary payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Payloads are retrieved in encrypted formats masked as PNG or JPG image files, and decrypted in memory using multi-byte XOR algorithms."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Subti downloaders?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block executable launches from temporary directories (%Temp%, %AppData%), deploy behavioral EDR monitoring, and inspect encrypted network streams."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1497.001",
    "T1055",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Password-Protected Archives",
    "Deceptive Software Download Mirrors",
    "Malvertising Redirects"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Secondary Binary Retrieval",
    "Anti-Sandbox Uptime & Cursor Checks",
    "In-Memory XOR Payload Decryption",
    "Process Injection into explorer.exe",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests to remote IP addresses retrieving binary blobs disguised as image files (.png, .jpg)",
      "Outbound HTTP POST beacons transmitting infected endpoint GUID and architecture details"
    ],
    "evasion_techniques": [
      "Tracking mouse cursor movements across consecutive API calls to detect headless sandbox analysis",
      "Encrypting command-and-control IP addresses and domain strings in the binary overlay"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
      "c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SubtiLoader",
      "HKCU\\Software\\Subti"
    ],
    "file_paths": [
      "%Temp%\\subti_setup.exe",
      "%AppData%\\Subti\\loader.exe",
      "%LocalAppdata%\\Temp\\payload.bin"
    ]
  },
  "defensive_measures": [
    "Configure Software Restriction Policies or AppLocker to block direct execution of unverified binaries from %Temp% and %AppData%",
    "Implement web content filtering to block downloads of executable files disguised under non-executable image MIME types",
    "Deploy endpoint behavioral analysis to detect sudden process injection from temporary executables into explorer.exe"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Subti",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Subti"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Subti",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Subti.A",
      "TrojanDownloader:Win32/Subti.B"
    ]
  },
  "motivation": "Initial Compromise & Multi-Stage Payload Delivery",
  "sample_hashes": []
}