{
  "family": "wecod",
  "sample_count": 71,
  "category": "trojan",
  "description": "Wecod (cataloged in antivirus vendor databases under detections including Trojan:Win32/Wecod, Trojan.Win32.Wecod, and Win32/Wecod) is a multi-functional Windows trojan and surveillance payload active since 2013. Infiltrating systems through bundled freeware installers, cracked software utilities, and phishing links, Wecod establishes covert residence to conduct endpoint surveillance and facilitate secondary payload distribution. Upon execution, Wecod unpacks its binary in memory, creates hidden startup entries in the Windows registry, and injects code into system processes. It hooks low-level keyboard APIs to log keystrokes, harvests credentials from local web browsers, and beacons system configuration data back to remote command-and-control servers over HTTP. Wecod also functions as a backdoor stager, capable of receiving remote commands to download and execute additional malware strains, such as banking trojans and click-fraud modules.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Wecod",
    "Trojan.Win32.Wecod",
    "Win32/Wecod"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Wecod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wecod is a Windows surveillance trojan that steals credentials, logs keystrokes, and downloads malware."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Wecod possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It captures keystrokes, steals browser passwords, and collects host configuration telemetry."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wecod maintain persistence on an infected machine?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows registry Run keys and installs hidden startup executables."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wecod spread to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through bundled third-party freeware installers, torrent keygens, and malicious email links."
      }
    },
    {
      "@type": "Question",
      "name": "How do you disinfect a system from Wecod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the infected executable using antimalware software, delete startup keys, and change all saved passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555.003",
    "T1547.001",
    "T1105",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Wecod from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Wecod persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Wecod attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Wecod modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Wecod dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Credential Theft & Surveillance",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Freeware Downloads",
    "Software Activators & Keygens",
    "Phishing Emails"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Low-Level Keystroke Logging",
    "Browser Password Harvesting",
    "Secondary Payload Downloading",
    "System Hardware Profiling",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting stolen keystrokes and credentials",
      "Periodic ping requests to C2 IP addresses"
    ],
    "evasion_techniques": [
      "In-memory payload decryption avoiding static file signatures",
      "Process injection into explorer.exe"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WecodClient",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinAudioService"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Sensitive credential compromise, personal keystroke monitoring, secondary malware infiltration"
  },
  "lineage": {
    "derived_from": [
      "Win32 Password Stealers & Spyware"
    ],
    "variants": [
      "Wecod.A",
      "Wecod.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b",
      "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c"
    ],
    "delivery": [
      "setup_patch.exe",
      "wecod_stager.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WecodDaemon",
      "%AppData%\\Wecod\\wecod.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Wecod",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Wecod"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.Wecod Overview",
      "url": "https://securelist.com"
    }
  ]
}