{
  "family": "xiclog",
  "sample_count": 44,
  "category": "backdoor",
  "description": "Xiclog (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/Xiclog, Trojan:Win32/Xiclog, and Backdoor.Xiclog) is a persistent Windows remote access trojan (RAT) and backdoor active since 2017. Delivered primarily through spearphishing emails with malicious attachments, weaponized Office documents, and drive-by exploit kits, Xiclog operates covertly to provide adversaries with interactive access. Upon execution, Xiclog establishes startup persistence via Windows scheduled tasks and Registry Run entries. It injects its malicious threads into legitimate system processes like svchost.exe to conceal outbound network traffic, connecting to remote C2 infrastructure over encrypted HTTP/HTTPS to execute arbitrary shell commands, harvest system telemetry, and drop secondary payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Xiclog",
    "Trojan:Win32/Xiclog",
    "Backdoor.Xiclog",
    "Win32/Xiclog",
    "Backdoor:Win32/Xiclog.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Xiclog?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Xiclog is a persistent Windows remote access trojan that grants attackers interactive command execution over infected endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers distribute Xiclog to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through spearphishing emails containing malicious document attachments and drive-by download exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xiclog conceal its network communications?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects its core communication modules into legitimate Windows system processes such as svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What remote capabilities are provided by Xiclog?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allows operators to run command prompt commands, upload/download files, capture system info, and stage secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How can incident responders remediate a Xiclog compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan, terminate injected svchost processes, audit scheduled tasks, and reset credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055",
    "T1547.001",
    "T1105",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Weaponized Office Documents",
    "Drive-By Exploit Kits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Interactive Remote Shell Execution",
    "Process Injection into svchost.exe",
    "Secondary Malware Staging",
    "File Upload & Exfiltration",
    "Registry Autostart & Task Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP/HTTPS POST beacons transmitting victim telemetry to C2 servers",
      "Periodic keep-alive heartbeat handshakes on high ports"
    ],
    "evasion_techniques": [
      "Injecting execution threads into legitimate svchost.exe processes",
      "Obfuscating internal API strings and dynamically resolving exports"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "3b42f2b3e449a57291dc8f781bb49f8b15df7264",
      "4ad9271649275819385920a19e48b3b42f2b3e44"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\XiclogClient"
    ],
    "file_paths": [
      "%AppData%\\Xiclog\\xiclog.exe",
      "%Temp%\\xiclog_cmd.tmp"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection rules for anomalous process injection into svchost.exe",
    "Enforce outbound network filtering restricting direct outbound connections from workstations",
    "Enable macro execution restrictions for email attachments in Microsoft Office"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Xiclog",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Xiclog"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:Win32/Xiclog.A",
      "Trojan:Win32/Xiclog!rfn"
    ]
  },
  "motivation": "Cyber espionage, Remote Endpoint Control & Initial Access Brokerage",
  "sample_hashes": []
}