{
  "family": "z_dem0n",
  "sample_count": 0,
  "category": "trojan",
  "description": "Z-dem0n (often styled as Z-dem0n, Z-Demon, or Backdoor.Win32.ZDemon) is an early-2000s Remote Access Trojan created in Delphi around 2002 by a developer using the handle 'ZnAsH'. Operating over direct TCP connections, Z-dem0n was engineered to provide unauthorized operators with administrative control over compromised Windows endpoints. Once executed on a target host, the server binary copies itself into system folders, configures persistence via Windows registry Run keys, and listens on a pre-configured port for incoming connections. The trojan provided comprehensive remote administration capabilities, including remote file system browsing, file upload and download, process enumeration and termination, registry hive manipulation, desktop screenshot capture, and keystroke logging.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Z-dem0n",
    "Z-Demon",
    "Backdoor.ZDemon",
    "Z-Dem0n by ZnAsH",
    "Backdoor:Win32/ZDemon"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Z-dem0n remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Z-dem0n is an early-2000s Delphi-based remote access trojan that grants unauthorized remote control and surveillance over Windows computers."
      }
    },
    {
      "@type": "Question",
      "name": "Who developed Z-dem0n?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Z-dem0n was created around 2002 by a developer operating under the handle 'ZnAsH' and circulated in underground hacking forums."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions could Z-dem0n perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allowed file transfers, keystroke monitoring, screen captures, process termination, registry editing, and system restarts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Z-dem0n maintain persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes executable startup references into HKCU and HKLM Software\\Microsoft\\Windows\\CurrentVersion\\Run registry keys."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Z-dem0n?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block unexpected listening ports at network firewalls, monitor registry autostart keys, and deploy standard antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2002,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Delphi Backdoor Era"
    ],
    "variants": [
      "Z-Dem0n 1.0",
      "Z-Dem0n 1.2",
      "Z-Dem0n Pro"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1113",
    "T1083",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the local network to sever unauthorized remote administration sessions.",
    "Kill the active Z-dem0n server process using Task Manager or administrative tools.",
    "Remove startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the server binary from the Windows System32 directory."
  ],
  "what_to_avoid": [
    "Do not execute software attachments received from unknown senders or IRC file exchanges.",
    "Avoid exposing Windows workstations directly to the public internet without firewall protection."
  ],
  "iocs": {
    "file_hashes": [
      "b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4",
      "1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a"
    ],
    "delivery": [
      "Distribution across vintage IRC file sharing channels and P2P networks",
      "Deceptive email attachments disguised as utility updates or games"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZDemonBackdoor",
      "%WINDIR%\\System32\\zdemon_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.ZDemon",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Malware Museum Historical Backdoor Archive - Z-Dem0n",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}