{
  "family": "klozet",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nKlozet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, more destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKlozet is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents) or via compromised software installers.\n\nUpon successful execution, Klozet operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Klozet ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` key) or by dropping a shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Klozet receives encrypted instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Klozet infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network or be fully encrypted by a secondary ransomware payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Klozet executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Klozet often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Klozet",
    "Downloader.Klozet",
    "Win32/Klozet"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:25:49Z",
  "type": "Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}