{
  "family": "filetour",
  "sample_count": 3238,
  "category": "pua",
  "description": "Trojan:Win32/FileTour is a hybrid threat acting as both a deceptive adware downloader and a stealthy cryptomining loader.<br><br><b>Understanding FileTour</b><br>To the victim, FileTour significantly degrades system performance, causing the computer's fans to spin loudly and applications to freeze. For incident responders, FileTour is a dual-pronged attack. Initially posing as a media codec or software installer, it floods the system with traditional adware. However, its primary, highly profitable payload is the silent installation of XMRig (or similar) cryptocurrency miners that hijack the endpoint's CPU and GPU resources.<br><br><b>Execution and Evasion Strategies</b><br>FileTour is typically encountered on illegal streaming sites, torrent trackers, or fake software crack portals. Once executed, it drops a massive barrage of bundled software to distract the user. Simultaneously, it injects a highly obfuscated cryptomining payload into legitimate system processes (like <code>svchost.exe</code> or <code>notepad.exe</code>) to hide its resource consumption from Task Manager. It establishes persistence via the Windows Startup folder or scheduled tasks. FileTour often utilizes anti-analysis techniques, pausing the cryptominer if it detects mouse movement or the opening of Task Manager.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should immediately investigate endpoints displaying sustained 100% CPU utilization. Network analysts will observe persistent outbound TCP connections over non-standard ports (e.g., 3333, 4444, 14444) indicative of Stratum mining protocol communications with mining pools. The presence of dropped E-mail spam modules or secondary adware in the <code>%Temp%</code> directory are also strong IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1105",
    "T1496",
    "T1562.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Disconnect the endpoint from the network to sever the Stratum protocol connection, immediately halting the cryptomining activity.",
    "Utilize EDR or memory forensics to identify and terminate the legitimate processes (like <code>svchost.exe</code>) that have been injected with the mining payload.",
    "Audit the firewall logs to identify the mining pool IP addresses and block them enterprise-wide.",
    "Perform a full system sweep to remove the vast amount of secondary adware and bundleware dropped by the FileTour installer."
  ],
  "what_to_avoid": [
    "Do not trust Task Manager to identify the malicious process; FileTour actively hooks APIs to hide its CPU usage or pauses when monitoring tools are opened.",
    "Avoid leaving the machine in a prolonged infected state, as the extreme thermal stress caused by cryptomining can cause hardware failure."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}