{
  "family": "xpaj",
  "sample_count": 14,
  "category": "file_infector",
  "description": "Xpaj (historically documented as Virus:Win32/Xpaj, W32/Xpaj, and Trojan.Xpaj) is a sophisticated polymorphic parasitic file infector and click-fraud botnet family active since 2009. Unlike simple droppers, Xpaj traverses local hard drives and accessible network shares, searching for Win32 Portable Executable (.exe, .dll, .scr) files and appending its encrypted polymorphic decryption engine into file slack spaces or newly created PE sections. Once executed on an infected machine, Xpaj establishes an encrypted peer-to-peer (P2P) and DNS-based C2 network, executing hidden browser instances to generate fraudulent click-through revenue on advertising networks. Because of its deep polymorphic file infection, disinfecting an endpoint requires dedicated antivirus removal tools or clean re-imaging to avoid binary corruption.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Virus:Win32/Xpaj",
    "W32/Xpaj.virus",
    "Win32/Xpaj.B",
    "Trojan.Win32.Xpaj",
    "Xpaj Infector"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Xpaj?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Xpaj is a polymorphic parasitic file infector that infects PE executables and operates a click-fraud botnet."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xpaj infect executable files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Portable Executable (PE) headers, adding polymorphic encrypted code into slack spaces or new sections."
      }
    },
    {
      "@type": "Question",
      "name": "What was the primary monetization mechanism of the Xpaj botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Click fraud: it spawns invisible browser processes to generate fraudulent clicks on online advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xpaj communicate with its command-and-control servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses a hybrid peer-to-peer (P2P) architecture and domain generation algorithms (DGA) to exchange encrypted instructions."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Xpaj infection difficult to clean?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it infects core system and third-party executables, requiring careful byte-level disinfection or complete system re-imaging."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1574.002",
    "T1027",
    "T1568.002",
    "T1071.001",
    "T1055",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection (File Infection)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information: Polymorphism",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1090.002",
      "name": "Connection Proxy: Peer-to-Peer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to prevent the P2P botnet from issuing commands and to halt potential lateral movement.",
    "Do NOT attempt to manually delete infected system files (e.g., `hal.dll`, `explorer.exe`), as this will render the system unbootable.",
    "Boot the system from a clean, read-only rescue environment (e.g., a WinPE Live USB) and run a specialized offline virus removal tool designed specifically to disinfect (rather than delete) Xpaj-altered files.",
    "Due to the deep rootkit hooks and the risk of incomplete disinfection, a complete bare-metal rebuild of the operating system is the most secure remediation strategy."
  ],
  "what_to_avoid": [
    "Avoid running standard antivirus remediation while the infected OS is active; the rootkit will actively lie to the AV scanner and protect the infected files.",
    "Do not trust the integrity of any executable file (`.exe`, `.dll`) extracted from the infected machine, even if it appears to be a legitimate corporate application."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Virus:Win32/Xpaj",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Xpaj"
    },
    {
      "name": "Kaspersky Threat Intelligence - Virus.Win32.Xpaj Technical Report",
      "url": "https://threats.kaspersky.com/en/threat/Virus.Win32.Xpaj/"
    },
    {
      "name": "MITRE ATT&CK - Hijack Execution Flow (T1574)",
      "url": "https://attack.mitre.org/techniques/T1574/"
    }
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}