{
  "family": "scar",
  "sample_count": 984,
  "category": "trojan_generic",
  "description": "Trojan:Win32/Scar is a broad heuristic and signature-based detection utilized primarily by Microsoft Defender to identify a prolific family of generic trojan downloaders and droppers.<br><br><b>Understanding Scar</b><br>For end-users, a Scar detection usually happens silently in the background, often when attempting to run a pirated software crack or keygen. For SOC analysts and incident responders, an alert for Trojan:Win32/Scar is a critical warning. Scar is rarely the final payload; it is a staging mechanism. Its primary function is to bypass initial security perimeters, profile the infected system, and securely download a devastating secondary payload—such as ransomware, banking trojans, or highly evasive rootkits.<br><br><b>Execution and Evasion Strategies</b><br>Scar variants rely heavily on deep obfuscation, packing (frequently using custom or modified packers like UPX), and polymorphism to evade signature-based detection. Upon execution, Scar often injects its unpacking routine into legitimate system processes (like <code>svchost.exe</code>) to hide its network activity. It establishes persistence via the Windows Registry or by dropping a shortcut in the Startup folder. Once secured, it connects to a remote Command-and-Control (C2) server—often utilizing compromised WordPress sites or hardcoded IP addresses—to fetch the final malware payload.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate any Scar detection thoroughly, even if the AV claims it was 'quarantined'. Investigators should analyze proxy and DNS logs for suspicious outbound requests that occurred immediately prior to the AV alert. The presence of randomly named executable files in the <code>%AppData%</code> or <code>%Temp%</code> directories, coupled with unexpected network connections from injected system processes, are strong IoCs of a successful Scar staging sequence.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1027.002",
    "T1055",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network to prevent the Scar dropper from successfully downloading the secondary payload.",
    "Perform a deep forensic scan to ensure no secondary payloads (such as ransomware or infostealers) were executed before the AV quarantined Scar.",
    "Analyze EDR and network logs to identify the C2 domains Scar attempted to contact, and block them enterprise-wide.",
    "Purge the Windows <code>%Temp%</code> and <code>%AppData%</code> directories of any obfuscated or randomly named executables."
  ],
  "what_to_avoid": [
    "Do not close out a Scar alert simply because the AV states the file was 'Blocked' or 'Quarantined'; always verify if secondary payloads were dropped.",
    "Do not execute suspicious files (like cracks or keygens) even in a VM without proper host isolation, as Scar may attempt to escape or profile the sandbox."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}