{
  "family": "trojna",
  "sample_count": 0,
  "category": "trojan",
  "description": "Trojna (cataloged across early antivirus archives as TrojNa$, Trojan.Trojna, and Backdoor.Win32.Trojna) is an early-2000s Remote Access Trojan created in Visual Basic and Delphi. Developed during the golden era of classic Windows backdoors, Trojna was designed to afford remote unauthorized operators comprehensive control over compromised Windows 9x, ME, and 2000 endpoints. Upon initial infection, Trojna copies its server binary into system folders, creates autostart registry entries under the Windows Run keys, and opens a persistent listening TCP socket to await commands from an attacker client console. The trojan features a wide range of remote administration capabilities, including file system browsing, file upload and download, remote process enumeration and termination, registry hive manipulation, system rebooting, desktop screen captures, and keystroke logging.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojNa$",
    "Backdoor.Trojna",
    "Trojan.Win32.Trojna",
    "TrojNa 1.0",
    "Backdoor:Win32/Trojna"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Trojna backdoor trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Trojna is an early-2000s remote access trojan that grants unauthorized remote control and monitoring over Windows endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "How does Trojna communicate with attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It opens a listening TCP port on infected machines, allowing operators with client software to connect and execute remote commands."
      }
    },
    {
      "@type": "Question",
      "name": "What actions can attackers take using Trojna?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers can browse and exfiltrate files, execute command line scripts, log keystrokes, view the desktop screen, and terminate processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Trojna maintain persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes executable startup references into the Windows registry Run keys and system configuration files."
      }
    },
    {
      "@type": "Question",
      "name": "How can Trojna infections be mitigated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect the host from the network, terminate active server processes, remove registry startup keys, and delete the server binary."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2001,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Vintage Win32 Backdoor Frameworks"
    ],
    "variants": [
      "Trojna 1.0",
      "Trojna 1.1",
      "Trojna.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1083",
    "T1105",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected computer from the local network to terminate active attacker sessions.",
    "Kill the Trojna server process using Task Manager or administrative command prompts.",
    "Remove startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the server binary from the Windows System32 directory."
  ],
  "what_to_avoid": [
    "Do not execute software attachments received from unknown sources or IRC chat networks.",
    "Avoid exposing Windows workstations directly to the public internet without firewall protection."
  ],
  "iocs": {
    "file_hashes": [
      "a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1",
      "4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f"
    ],
    "delivery": [
      "Distribution across vintage IRC file sharing channels and P2P networks",
      "Deceptive email attachments masquerading as software tools or games"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TrojnaServer",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TrojnaSys"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.Trojna",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Malware Museum Historical Backdoor Archive - Trojna",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}