{
  "family": "vampire",
  "sample_count": 0,
  "category": "trojan",
  "description": "Vampire (also documented across security definitions as Vampire RAT, Vampire Trojan, and Backdoor.Win32.Vampire) is a vintage Remote Access Trojan created in 2000. Engineered as a client-server administration and surveillance framework for Windows 95, 98, and NT, Vampire allows unauthorized remote operators to manipulate compromised endpoints across raw TCP network connections. Once installed, the Vampire server binary registers itself under Windows autostart registry Run keys, hides its process from rudimentary system task lists, and opens a listening port for inbound connections from the operator client. The backdoor features a wide range of remote surveillance and control commands, including file system browsing, file transfer, registry tampering, remote process termination, keystroke interception, desktop viewing, and hardware disruption routines such as opening CD-ROM drives and flipping display settings.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Vampire RAT",
    "Backdoor.Vampire",
    "Trojan.Win32.Vampire",
    "Vampire Trojan",
    "Backdoor:Win32/Vampire"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Vampire remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vampire is a vintage Windows remote access trojan from 2000 that enables unauthorized remote administration and surveillance."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vampire communicate with attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The server binary listens on a configured TCP port, allowing attackers with client software to establish direct administrative sessions."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions could Vampire perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allowed file transfers, keystroke monitoring, screen captures, process termination, registry editing, and hardware pranks."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vampire maintain persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds startup entries to the Windows registry Run keys and system initialization files like win.ini."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Vampire?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block unexpected listening ports at network firewalls, monitor registry autostart keys, and deploy standard antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2000,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Win32 Backdoor Era"
    ],
    "variants": [
      "Vampire 1.0",
      "Vampire 2.0",
      "Vampire.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1113",
    "T1083",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the local network to sever unauthorized remote administration sessions.",
    "Kill the Vampire server process using Task Manager or administrative tools.",
    "Clean malicious entries from the Windows registry Run keys and win.ini files.",
    "Delete the server binary from the Windows System directory and perform a full antivirus scan."
  ],
  "what_to_avoid": [
    "Do not execute software attachments received from unknown sources or IRC file exchanges.",
    "Avoid exposing Windows workstations directly to the public internet without firewall protection."
  ],
  "iocs": {
    "file_hashes": [
      "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f",
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b"
    ],
    "delivery": [
      "Distribution across vintage IRC file sharing channels and P2P networks",
      "Deceptive email attachments disguised as multimedia files or game patches"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VampireServer",
      "%WINDIR%\\System32\\vampire.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.Vampire",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Malware Museum Historical Backdoor Archive - Vampire",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}