{
  "family": "zippyloader",
  "sample_count": 40,
  "category": "trojan_downloader",
  "description": "Zippyloader (cataloged across security vendors and threat intelligence databases under signatures including TrojanDownloader:Win32/Zippyloader, Trojan:Win32/Zippyloader, and Dropper.Zippyloader) is a stealthy Windows trojan downloader and payload delivery framework active since 2017. Infiltrating endpoints primarily through deceptive freeware installers, weaponized email attachments, and cracked utilities, Zippyloader acts as an initial access broker tool. Upon execution, the malware profiles the target host, establishes persistence through Windows Registry Run keys, and drops randomized staging executables into user temporary directories. Zippyloader initiates encrypted HTTP communications with remote command-and-control servers to download and execute secondary high-severity payloads such as banking trojans, information stealers, and ransomware.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Zippyloader",
    "Trojan:Win32/Zippyloader",
    "Dropper.Zippyloader",
    "Win32/Zippyloader",
    "TrojanDownloader:Win32/Zippyloader.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Zippyloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zippyloader is a stealthy Windows trojan downloader designed to fetch and execute secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zippyloader infect endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly distributed through deceptive software downloads, cracked application packages, and malicious emails."
      }
    },
    {
      "@type": "Question",
      "name": "Where does Zippyloader drop its execution artifacts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It unpacks randomized staging binaries and configuration scripts into user %AppData% and %Temp% directories."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically delivered by Zippyloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It delivers secondary payloads including credential stealers, banking trojans, and crypto-ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams remediate Zippyloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan, clean the %Temp% directory, and remove unauthorized Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1071.001",
    "T1082",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Software Cracks & Keygens",
    "Malicious Phishing Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "Host Environment Profiling",
    "Encrypted C2 Telemetry Beaconing",
    "Temporary Directory File Dropping",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded system telemetry to C2 servers",
      "Outbound TLS connections fetching secondary executable stages"
    ],
    "evasion_techniques": [
      "Execution from volatile temporary user directories (%Temp%)",
      "Dynamic API resolution to evade static import table detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "c3f8194ad9271649275819385920a19e48b3b42f",
      "891bb49f8b15df726489312bcf8194ad92716492"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZippyloaderService"
    ],
    "file_paths": [
      "%Temp%\\zippy_loader.exe",
      "%AppData%\\Zippyloader\\client.bin"
    ]
  },
  "defensive_measures": [
    "Block executable execution from user temp paths (%Temp%)",
    "Deploy endpoint detection and response (EDR) to monitor unauthorized child process spawning",
    "Audit Windows Registry Run keys regularly for unknown persistence entries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Zippyloader",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Zippyloader"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Zippyloader.A",
      "TrojanDownloader:Win32/Zippyloader!rfn"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Threat Staging",
  "sample_hashes": []
}