{
  "family": "vindor",
  "sample_count": 63,
  "category": "trojan",
  "description": "Vindor (cataloged across security vendors under detections including Trojan:Win32/Vindor, Trojan.Win32.Vindor, and Win32/Vindor) is a multi-stage Windows trojan and initial access stager active since 2014. Distributed predominantly through deceptive software installers, pirated utilities, and malicious email links, Vindor unpacks obfuscated binaries in memory to evade static endpoint heuristics. Once executed, Vindor gathers basic host telemetry, verifies internet connectivity, and contacts remote command-and-control servers over HTTP. It downloads and executes secondary malicious payloads, such as cryptocurrency miners, browser hijackers, and ransomware precursors, saving them into temporary directories like %Temp% or %AppData%. Vindor maintains persistence through Windows registry Run keys and scheduled background maintenance tasks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Vindor",
    "Trojan.Win32.Vindor",
    "Win32/Vindor"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Vindor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vindor is a Windows trojan downloader that gathers system telemetry and installs secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vindor deliver secondary payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It connects to remote C2 servers via HTTP, downloads binaries into %Temp%, and executes them silently."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vindor establish persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures startup entries in the Windows registry and creates scheduled background tasks."
      }
    },
    {
      "@type": "Question",
      "name": "What threats are commonly staged by Vindor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently drops cryptocurrency miners, browser hijackers, and initial access backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove Vindor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clear temporary folders, remove startup registry keys and scheduled tasks, and run a full antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1027",
    "T1547.001",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Vindor payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Vindor persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Malware Staging & Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Installers",
    "Pirated Software Packages",
    "Phishing Email Links"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "Host Hardware Profiling",
    "Registry Autostart Persistence",
    "Scheduled Task Creation",
    "Encrypted HTTP C2 Beaconing"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests fetching binary payloads from remote IP addresses",
      "Host telemetry beacons transmitting OS version and CPU architecture"
    ],
    "evasion_techniques": [
      "Unpacking payloads dynamically in RAM",
      "Saving downloaded files with randomized alphanumeric names in %Temp%"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VindorService",
      "Windows Task Scheduler tasks configured under %AppData%\\Vindor"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Unauthorized secondary software installation, system resource drain, persistent host compromise"
  },
  "lineage": {
    "derived_from": [
      "Win32 Trojan Downloader Toolkits"
    ],
    "variants": [
      "Vindor.A",
      "Vindor.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e",
      "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f"
    ],
    "delivery": [
      "software_bundle.exe",
      "vindor_loader.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VindorDaemon",
      "%Temp%\\vindor_host.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Vindor",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vindor"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Vindor",
      "url": "https://www.trendmicro.com"
    }
  ]
}