{
  "family": "vigorf",
  "sample_count": 45,
  "category": "trojan",
  "description": "Vigorf is a pervasive Windows trojan downloader and ransomware stager cataloged under Microsoft Defender signatures including Trojan:Win32/Vigorf.A. Infiltrating endpoints primarily through cracked game packages, pirated software activators, and malicious torrent archives, Vigorf executes multi-stage obfuscated loaders to bypass host security protections. Upon execution, the malware establishes persistence through registry autostart keys under CurrentVersion\\Run, disables Windows Defender notifications, and beacons remote C2 servers to download secondary malicious components—frequently serving as the delivery mechanism for STOP/DJVU ransomware strains and RedLine infostealers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Vigorf.A",
    "Trojan:Win32/Vigorf",
    "TrojanDownloader:Win32/Vigorf",
    "Win32/Vigorf"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Vigorf?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vigorf is a pervasive trojan downloader that stages secondary malware such as ransomware and infostealers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vigorf enter victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through cracked game packages, software keygens, and malicious torrent file downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware is commonly deployed by Vigorf?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently deploys STOP/DJVU ransomware strains, RedLine infostealers, and cryptocurrency miners."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vigorf persist across Windows reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds autostart values to the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How do you disinfect a computer from Vigorf?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the file using Microsoft Defender, clean startup registry keys, and clear temporary extraction folders."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1562.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Vigorf from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Vigorf persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Vigorf attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Vigorf modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Vigorf dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Malware Staging & Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Cracked Game Packages",
    "Software Keygens & Activators",
    "Malicious Torrent Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Malware Staging",
    "Registry Autostart Persistence",
    "Windows Defender Suppression",
    "Encrypted C2 Communication",
    "System Profiling"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons reporting host GUIDs to remote C2 IP endpoints",
      "HTTP GET requests downloading encrypted secondary ransomware archives"
    ],
    "evasion_techniques": [
      "Multi-layer packing and XOR string obfuscation",
      "Disabling Windows Defender notification popups",
      "Sleep timers to delay malicious execution in sandboxes"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Vigorf\\vigorf_stager.exe",
        "%Temp%\\secondary_payload.exe"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VigorfStager"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Vigorf Downloader Family"
    ],
    "variants": [
      "Vigorf.A",
      "Vigorf.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "ab78bc89cd90123456789abcdef0123456789abcdef0123456789abcdef012345",
      "bc89cd90de0123456789abcdef0123456789abcdef0123456789abcdef0123456"
    ],
    "delivery": [
      "steam_game_crack_setup.exe",
      "adobe_photoshop_activator.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VigorfStager"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Vigorf.A",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vigorf.A"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.VIGORF",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.vigorf"
    }
  ]
}