{
  "family": "xpaj",
  "sample_count": 14,
  "category": "trojan",
  "description": "Virus:Win32/Xpaj is a highly sophisticated, polymorphic file infector and botnet agent that was exceptionally prevalent in the early 2010s. Unlike standard trojans that simply drop a malicious payload, Xpaj actively seeks out and infects legitimate Windows executable files (`.exe`, `.dll`, `.sys`) and web files (`.htm`, `.php`), inserting its own malicious code into them to establish deep, system-wide persistence and facilitate large-scale click fraud and cryptocurrency mining.<br><br><b>Understanding the Xpaj File Infector</b><br>To a standard user, an Xpaj infection might initially go unnoticed, though system performance often degrades significantly. For a security analyst, Xpaj represents a nightmare scenario: a self-replicating virus that fundamentally alters the integrity of the operating system's core files. Because it infects legitimate files (like `explorer.exe` or network drivers), simply deleting the 'malware' is impossible without destroying the operating system itself.<br><br><b>Execution and Polymorphic Infection Mechanics</b><br>Xpaj is typically distributed via drive-by downloads or removable media (`T1091`). Upon execution, the malware unpacks itself in memory. It then recursively scans the hard drive (`T1083`) looking for target files. When it finds a target (e.g., a `.dll`), it uses advanced polymorphism (`T1027`) to uniquely encrypt its payload and injects it into a new section within the target file (`T1055`), modifying the entry point so the virus runs before the legitimate program. It also utilizes a complex rootkit component (`T1014`) to hide its presence, hook system APIs, and prevent antivirus software from reading the infected files. Infected machines are enlisted into a peer-to-peer (P2P) botnet (`T1090.002`) to receive commands, typically instructing the host to perform invisible ad-clicking (click fraud) or download further payloads.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe system compromise and a high likelihood of necessary OS reinstallation. Incident responders will observe anomalous network traffic (P2P communication over random high ports). Antivirus scans will report thousands of core system files as 'infected' rather than finding a single malicious dropper. Advanced memory forensics will reveal extensive API hooking (SSDT/IRP hooks) by the rootkit module.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1083",
    "T1014",
    "T1055",
    "T1027",
    "T1090.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection (File Infection)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information: Polymorphism",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1090.002",
      "name": "Connection Proxy: Peer-to-Peer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to prevent the P2P botnet from issuing commands and to halt potential lateral movement.",
    "Do NOT attempt to manually delete infected system files (e.g., `hal.dll`, `explorer.exe`), as this will render the system unbootable.",
    "Boot the system from a clean, read-only rescue environment (e.g., a WinPE Live USB) and run a specialized offline virus removal tool designed specifically to disinfect (rather than delete) Xpaj-altered files.",
    "Due to the deep rootkit hooks and the risk of incomplete disinfection, a complete bare-metal rebuild of the operating system is the most secure remediation strategy."
  ],
  "what_to_avoid": [
    "Avoid running standard antivirus remediation while the infected OS is active; the rootkit will actively lie to the AV scanner and protect the infected files.",
    "Do not trust the integrity of any executable file (`.exe`, `.dll`) extracted from the infected machine, even if it appears to be a legitimate corporate application."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}