{
  "family": "zapchast",
  "sample_count": 32,
  "category": "infostealer",
  "description": "Zapchast (tracked across security intelligence catalogs under signatures including Trojan:Win32/Zapchast, Trojan-PSW.Win32.Zapchast, and PWS:Win32/Zapchast) is a covert Windows password-stealing trojan and infostealer active since 2016. Often distributed through trojanized software keygens, torrented utility archives, and phishing emails, Zapchast is engineered to harvest stored authentication credentials across victim endpoints. Upon execution, Zapchast inspects local storage, querying sqlite databases and DPAPI-protected vaults used by web browsers (Chrome, Firefox, Opera, Edge) to extract saved website logins, cookies, and autofill entries. Additionally, Zapchast targets credentials from FTP clients, email software, and cryptocurrency wallets. The extracted credentials and host hardware profiles are bundled into encrypted binary packets and exfiltrated over HTTP POST to threat actor drop servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Zapchast",
    "Trojan-PSW.Win32.Zapchast",
    "PWS:Win32/Zapchast",
    "Win32/Zapchast",
    "Trojan.Zapchast"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Zapchast?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zapchast is a password-stealing trojan that extracts stored login credentials, cookies, and cryptocurrency wallet data from Windows endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "Which applications are targeted by Zapchast?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zapchast targets major web browsers (Chrome, Firefox, Edge, Opera), FTP clients, email clients, and desktop cryptocurrency wallets."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zapchast exfiltrate stolen passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It packages collected credentials and host system profiles into encrypted archives and transmits them via HTTP POST requests to remote drop servers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zapchast evade detection on the system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It decrypts browser DPAPI vaults in memory, operates without opening visible windows, and executes self-deletion scripts following exfiltration."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps are needed after a Zapchast infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately reset passwords for all accounts accessed on the infected machine, invalidate active web session cookies, and enable Multi-Factor Authentication."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1555.004",
    "T1041",
    "T1070.004",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Software Keygens",
    "Phishing Email Attachments",
    "Malicious Torrent Archives"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Web Browser DPAPI Vault Decryption",
    "Cookie & Session Hijacking",
    "FTP & Email Client Password Theft",
    "Cryptocurrency Wallet Directory Scraping",
    "Encrypted HTTP POST Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST requests transmitting serialized credential archives with custom boundary markers",
      "Periodic telemetry beacons reporting count of harvested passwords and host GUID"
    ],
    "evasion_techniques": [
      "Decrypting DPAPI master keys in memory without spawning external command-line utilities",
      "Self-deletion routines using temporary cmd scripts upon successful exfiltration"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2",
      "04b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZapchastAgent"
    ],
    "file_paths": [
      "%Temp%\\zapchast.exe",
      "%AppData%\\Zapchast\\creds.dat",
      "%LocalAppdata%\\Temp\\report.bin"
    ]
  },
  "defensive_measures": [
    "Enforce Multi-Factor Authentication (MFA) across all enterprise and personal online services to mitigate credential theft",
    "Deploy endpoint security that monitors unauthorized processes querying browser User Data directories and DPAPI blobs",
    "Block outbound HTTP traffic to newly registered domains and unclassified external IP drops"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Zapchast",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Zapchast"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Zapchast",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Zapchast.A",
      "Trojan-PSW:Win32/Zapchast.gen"
    ]
  },
  "motivation": "Credential Theft, Identity Hijacking & Dark Web Resale",
  "sample_hashes": []
}