{
  "family": "wakme",
  "sample_count": 116,
  "category": "trojan",
  "description": "Wakme (cataloged across security vendors as TrojanDownloader:Win32/Wakme, TROJ_WAKME.A, and Trojan:Win32/Wakme) is a modular trojan downloader and initial access staging tool active since 2013. Engineered to breach endpoint defenses and deliver secondary high-severity payloads—including banking trojans, information stealers, and ransomware droppers—Wakme is commonly distributed through malicious email spam campaigns with weaponized attachments (such as macro-enabled Word documents or compressed ZIP archives) and drive-by web exploit kits. Upon execution, Wakme executes robust anti-analysis and sandbox-evasion routines, verifying system memory, processor core counts, and mouse movement to detect automated analysis environments. If a live victim endpoint is confirmed, Wakme drops a lightweight binary into %TEMP% or %LOCALAPPDATA%, secures autostart persistence via Registry Run keys, and hollows out legitimate Windows processes (such as explorer.exe or svchost.exe) to inject its downloading routine. It establishes encrypted C2 communications, retrieving and executing secondary malware modules.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Wakme",
    "Trojan:Win32/Wakme",
    "TROJ_WAKME.A",
    "Win32/Wakme",
    "Trojan.Wakme"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Wakme trojan family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wakme is a modular Windows trojan downloader that establishes initial access to retrieve secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wakme arrive on target computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed via malicious email attachments, spearphishing macros, and drive-by download exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wakme evade sandbox analysis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtual machine artifacts, system uptime, and mouse movement before initiating network activity."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wakme achieve persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds disguised executable entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can Wakme and its dropped payloads be eliminated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate injected processes, audit %TEMP% for dropped binaries, and run an offline antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2013,
  "motivation": "Payload Delivery",
  "lineage": {
    "derived_from": [
      "Modular Trojan Downloader Architecture",
      "Evasive Initial Access Dropper"
    ],
    "variants": [
      "Wakme.A",
      "Wakme.B",
      "Wakme.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1204.002",
    "T1105",
    "T1497.001",
    "T1055",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately to sever the downloader's communication with C2 payload staging servers.",
    "Inspect active processes for anomalous injection into explorer.exe or svchost.exe.",
    "Delete persistent registry run keys in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and purge files in %TEMP%.",
    "Perform a complete endpoint security scan to identify and eliminate secondary malware payloads delivered by Wakme."
  ],
  "what_to_avoid": [
    "Do not open unexpected archive attachments or enable macros in email documents originating from unknown sources.",
    "Avoid allowing internet access to the machine until full forensic verification and remediation are complete."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Financial Services",
    "Manufacturing"
  ],
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "ingress_transfer",
    "defense_evasion",
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "iocs": {
    "file_hashes": [
      "d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7",
      "e6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2d4f6a8"
    ],
    "delivery": [
      "Malicious spam email campaigns with password-protected archive attachments",
      "Exploit kit landing pages targeting vulnerable browser components"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WakmeUpdate",
      "%TEMP%\\wakme.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - TrojanDownloader:Win32/Wakme",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Wakme"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - TROJ_WAKME.A",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}