{
  "family": "benjamin",
  "sample_count": 153,
  "category": "trojan_generic",
  "description": "Worm:Win32/Benjamin is a classic, highly disruptive network worm specifically engineered to propagate wildly across Peer-to-Peer (P2P) file-sharing networks by masquerading as highly desirable software or media files.<br><br><b>Understanding Benjamin</b><br>To the average user utilizing legacy P2P networks (like Kazaa, Limewire, or eMule), Benjamin appears to be a successful download of a popular movie, crack, or application. For incident responders, Benjamin represents a severe bandwidth and storage consumption threat. Its primary objective is aggressive self-replication, turning the infected endpoint into a massive distribution hub for the worm.<br><br><b>Execution and Evasion Strategies</b><br>The infection cycle begins when a user downloads and executes a file named something enticing (e.g., <code>Photoshop_Crack.exe</code>) from a P2P network. Upon execution, the Benjamin worm drops its core payload into the Windows System directory and establishes persistence via the Registry Run keys. It then actively searches the endpoint for the shared folders utilized by installed P2P applications. Once located, Benjamin rapidly copies itself hundreds of times into these shared folders, dynamically renaming the copies to match the most frequently searched terms on the P2P network at that time.<br><br><b>Indicators of Compromise & Impact</b><br>The immediate impact is massive hard drive consumption and severe network congestion as other P2P users download the thousands of fake files now hosted by the victim. Incident responders will notice the P2P shared folders suddenly filled with hundreds of identically sized executable files (.exe) masquerading as .mp3s, .avis, or .zips. EDR tools will flag the rapid, automated creation of executables within specific directory paths.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1498",
    "T1547.001",
    "T1036.004",
    "T1091",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Keep Original File Name",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the massive outbound bandwidth consumption caused by P2P uploads.",
    "Identify and completely uninstall the P2P file-sharing application (e.g., Kazaa, eMule, BitTorrent clients) that facilitated the infection.",
    "Locate the P2P shared directory and permanently delete the hundreds of fake, replicated executable files generated by the worm.",
    "Utilize a full EDR sweep to locate and remove the core Benjamin executable running from the Windows System directory and its associated Run keys."
  ],
  "what_to_avoid": [
    "Do not simply delete the fake files in the shared folder without killing the core process; the worm will recreate them instantly.",
    "Avoid allowing P2P file-sharing applications on corporate networks; they are a massive vector for worms, malware, and data leakage."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}