{
  "family": "terabit_virus_maker",
  "sample_count": 0,
  "category": "trojan",
  "description": "Terabit Virus Maker (abbreviated as TVM and identified in security definitions as HackTool.Win32.Terabit) is an automated malware generation kit and script virus constructor created around 2007 by an Iranian malware author known as 'm_reza00'. Designed with a point-and-click graphical interface, TVM enabled non-technical threat actors to assemble multi-stage Windows destructive trojans and worms. The builder allowed operators to select modular payload routines, including disabling critical Windows security components (Windows Defender, Firewall, Task Manager, Registry Editor, and Command Prompt), terminating running antivirus processes, deleting system restore points, modifying system file attributes, and dropping secondary malicious executables. Trojans compiled with Terabit Virus Maker established persistent registry autostart hooks and frequently weaponized VBScript and batch scripting wrappers to evade rudimentary signature-based antivirus scanners.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TVM",
    "Terabit Virus Maker by m_reza00",
    "HackTool.Win32.Terabit",
    "Terabit Trojan Generator",
    "Terabit 2.8"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Terabit Virus Maker construction kit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terabit Virus Maker is an automated malware generator that allowed operators to compile customized Windows trojans, worms, and destructive scripts."
      }
    },
    {
      "@type": "Question",
      "name": "Who developed Terabit Virus Maker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was developed around 2007 by an author using the handle 'm_reza00' and distributed across underground hacking forums."
      }
    },
    {
      "@type": "Question",
      "name": "What system defenses do Terabit-generated payloads target?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Payloads disable Windows Task Manager, the Registry Editor, Windows Firewall, and terminate active antivirus processes."
      }
    },
    {
      "@type": "Question",
      "name": "How did Terabit malware achieve persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It created autostart registry entries under the Run and RunOnce keys and added batch script execution commands to system startup."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems compromised by TVM payloads be repaired?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Safe Mode, remove malicious startup entries, re-enable Task Manager and regedit via Group Policy, and clean dropped script files."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2007,
  "motivation": "Sabotage",
  "lineage": {
    "derived_from": [
      "Script Virus Construction Kits"
    ],
    "variants": [
      "TVM 1.0",
      "TVM 2.0",
      "TVM 2.8"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1562.001",
    "T1547.001",
    "T1112",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Boot into Windows Safe Mode to prevent execution of disabled administration tool policies.",
    "Re-enable Task Manager and Registry Editor by modifying registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System.",
    "Delete malicious batch and VBS script files from %SYSTEMROOT% and user temporary folders.",
    "Remove persistence keys under HKCU and HKLM Run and RunOnce locations."
  ],
  "what_to_avoid": [
    "Do not execute unverified batch files, VBScripts, or compiled builders downloaded from underground hacking communities.",
    "Avoid granting administrative privileges to unknown executable setup files."
  ],
  "iocs": {
    "file_hashes": [
      "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c",
      "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d"
    ],
    "delivery": [
      "Distribution of virus construction software across underground forums and file sharing portals",
      "Compiled trojan attachments delivered via malicious email archives"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TerabitStartup",
      "%WINDIR%\\System32\\tvm_driver.bat"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - HackTool.Win32.Terabit",
      "url": "https://threats.kaspersky.com"
    },
    {
      "name": "Malware Museum Historical Construction Kit Archive - Terabit",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}