{
  "family": "volt",
  "sample_count": 30,
  "category": "trojan",
  "description": "Volt (cataloged across security intelligence feeds under signatures including Trojan:Win32/Volt, TrojanDownloader:Win32/Volt, and Trojan.Volt) is a versatile multi-stage Windows trojan loader and botnet implant active since 2016. Infiltrating endpoints primarily through drive-by downloads, exploit kit redirections, and weaponized torrent archives, Volt is designed to establish an initial persistent foothold and coordinate secondary malware operations. Once executed, Volt conducts host reconnaissance to collect operating system version data, CPU details, and installed security software. It installs persistence via the Windows Registry CurrentVersion\\Run key and initiates encrypted outbound HTTP/HTTPS beaconing to command-and-control servers. Cybercriminals use Volt as a loader framework to deploy secondary payloads, including modular credential stealers, cryptocurrency miners, and ransomware implants.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Volt",
    "TrojanDownloader:Win32/Volt",
    "Trojan.Volt",
    "Win32/Volt",
    "Trojan:Win32/Volt.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Volt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Volt is a multi-stage Windows trojan loader used by threat actors to stage secondary malware such as stealers and cryptominers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Volt infect Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infects systems through drive-by downloads, exploit kit landing pages, and malicious torrent software bundles."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are deployed by Volt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Volt is frequently observed downloading cryptocurrency miners, banking trojans, and password-stealing tools."
      }
    },
    {
      "@type": "Question",
      "name": "How does Volt maintain persistence on compromised hosts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autorun registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and schedules background tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators defend against Volt trojan infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block downloads from untrusted sources, restrict script execution in temporary directories, and use behavioral EDR solutions."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1105",
    "T1082",
    "T1055",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Exploit Kit Drive-by Downloads",
    "Malicious Torrent Repackagers",
    "Phishing Emails with Weaponized Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Staging & Execution",
    "System Hardware & OS Profiling",
    "Process Injection into svchost.exe",
    "Encrypted Command & Control Beaconing",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Encrypted Stager Payload (.dat)"
    ],
    "network_signatures": [
      "HTTP POST beacons transmitting serialized JSON telemetry to remote C2 endpoints",
      "HTTP GET requests fetching XOR-encrypted binary payloads disguised as PNG or GIF images"
    ],
    "evasion_techniques": [
      "Process hollowing into svchost.exe or explorer.exe to conceal malicious execution",
      "Dynamic API resolution via PEB hash lookups to foil static import detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "37e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7",
      "48f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VoltLoader",
      "HKCU\\Software\\Volt"
    ],
    "file_paths": [
      "%Temp%\\volt_agent.exe",
      "%AppData%\\Volt\\config.dat",
      "%LocalAppdata%\\Temp\\payload.bin"
    ]
  },
  "defensive_measures": [
    "Enforce endpoint behavioral monitoring to detect process hollowing and memory manipulation in svchost.exe",
    "Filter web gateway traffic to block executable downloads from unclassified domains and newly created IPs",
    "Apply Software Restriction Policies preventing binary execution from user profile directories (%Temp%, %AppData%)"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Volt",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Volt"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Volt",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Volt.A",
      "Trojan:Win32/Volt.B"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Crimeware Staging",
  "sample_hashes": []
}