{
  "family": "genericrxda",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Trojan:Win32/Genericrxda is a generic, heuristic-based detection name used by Microsoft Defender and other AV engines to classify a wide variety of persistent, stealthy trojans designed to breach endpoint defenses and securely deliver secondary payloads. Because it is a generic detection, it often catches custom or heavily obfuscated malware acting as an 'Initial Access Broker' tool.<br><br><b>Understanding Genericrxda</b><br>To an end-user, a Genericrxda infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, a generic detection like this means the AV engine recognized malicious *behavior* or code structure, but couldn't identify the specific malware family. Its primary objective is to securely bypass endpoint defenses and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload (like ransomware).<br><br><b>Execution and Evasion Strategies</b><br>Generic trojans are commonly distributed via massive malspam campaigns containing weaponized attachments or through exploit kits. Upon execution, they utilize heavy packing and dynamic API resolution to evade static signatures. They drop a randomized executable into the `%Temp%` or `%AppData%` directory. They establish persistence by creating a hidden scheduled task or modifying the Registry Run keys. They frequently inject their downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal the trojan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were actually requested.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1105",
    "T1027",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading secondary payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Hiding within svchost.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Triggering generic heuristic detections)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent the trojan from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains the trojan attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial generic dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on static file deletion, as injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}