{
  "family": "vilsel",
  "sample_count": 74,
  "category": "trojan",
  "description": "Vilsel (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Vilsel, Trojan.Win32.Vilsel, and Trojan.Vilsel) is a pervasive Windows trojan and initial access stager active since 2011. Distributed primarily through trojanized software activators, pirated media downloads, and malicious email attachments, Vilsel executes multi-stage evasion routines upon initial compromise. Once active, the trojan copies itself under randomized alphanumeric filenames into %Temp%, %AppData%, or the Windows system directory and establishes persistence via registry autostart keys. Vilsel actively impairs local defenses by attempting to disable the Windows Firewall, terminate Task Manager, and suppress User Account Control (UAC) prompts. It establishes outbound HTTP command-and-control communication to download and stage secondary malicious payloads, including banking trojans, cryptocurrency miners, and backdoor tools.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Vilsel",
    "Trojan.Win32.Vilsel",
    "Trojan.Vilsel",
    "Trojan:Win32/Vilsel!MTB"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Vilsel?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vilsel is a malicious trojan stager that disables security features and downloads secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vilsel impair Windows system defenses?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies registry settings to disable the Windows Firewall, Task Manager, and User Account Control prompts."
      }
    },
    {
      "@type": "Question",
      "name": "Where does Vilsel hide on an infected computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It drops copies with randomized names in %Temp%, %AppData%, and the Windows directory."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vilsel infect user systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through cracked software downloads, torrent keygens, and malicious phishing attachments."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators disinfect a Vilsel compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a bootable offline antimalware scan, reset firewall and registry policies, and update all network credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1547.001",
    "T1105",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; the aggressive system modifications make the machine fundamentally untrustworthy and likely open to secondary payloads.",
    "Utilize EDR or offline registry analysis tools to identify and reverse the malicious registry modifications (especially those disabling security tools).",
    "Audit the `HOSTS` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`) and remove any entries redirecting security vendor domains to `127.0.0.1`.",
    "Due to the depth of the system modifications, the most secure remediation is a complete, clean rebuild of the operating system."
  ],
  "what_to_avoid": [
    "Do not trust the endpoint's built-in security tools or logs; a Vilsel infection is explicitly designed to disable or tamper with these mechanisms.",
    "Avoid relying solely on automated AV removal, as the malware may have replaced legitimate system files that AV cannot safely delete."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Unauthorized Access & Malware Distribution",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Cracked Software & Keygens",
    "Torrent Downloads",
    "Phishing Emails with Malicious Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Disabling Windows Firewall and Task Manager",
    "Secondary Payload Downloading",
    "Randomized Directory Dropping",
    "Registry Autostart Persistence",
    "HTTP C2 Communications"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests to remote IP addresses fetching encrypted binary payloads",
      "User-Agent strings mimicking Internet Explorer"
    ],
    "evasion_techniques": [
      "Disabling native Windows security and monitoring tools",
      "Copying itself to randomized alphanumeric executable names"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VilselSvc",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinSecurityHost"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Disabled security defenses, secondary malware infection, unauthorized network traffic"
  },
  "lineage": {
    "derived_from": [
      "Win32 Multi-Stage Trojan Droppers"
    ],
    "variants": [
      "Vilsel.A",
      "Vilsel.MTB"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d",
      "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e"
    ],
    "delivery": [
      "keygen_patch.exe",
      "installer_update.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VilselService",
      "%Temp%\\a7b8c9d0.exe"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist - Trojan.Win32.Vilsel Analysis",
      "url": "https://securelist.com"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Vilsel",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vilsel"
    }
  ]
}