Analysis by: Cris Nowell Pantanilla


Windows, Windows 64-bit


  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes


REGIN is a sophisticated malware that has been used to target high profile victims. REGIN uses a variety of advanced evasion techniques. such as the use of multiple infection chains and modules, to avoid detection in order to steal information.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.


File Size:


File Type:


Memory Resident:


Initial Samples Received Date:

24 Nov 2014


Compromises system security, Steals information


This is the Trend Micro detection for malicious files that belong to malware group Regin. This is a multi-component malware that uses different files for its functionalities and payload.


The initial load file is responsible for initializing the routines. This file is usually found in the "System32" folder and may use any of the following filenames:

  • abiosdsk.sys
  • adpu160.sys
  • atdisk.sys
  • cdaudio.sys
  • floppy.sys
  • ndisips.sys
  • parclass.sys
  • pciclass.sys
  • pcidump.sys
  • pciport.sys
  • rasprt.sys
  • rdpmdd.sys
  • Ser8UART.sys
  • serial.sys
  • usbclass.sys

This malware does not store files using the usual file system for its installation. Rather, it stores components in the NTFS Extended Attributes or a registry blob:

  • Extended Attrbibutes:
    • %Windows%
    • %Windows%\fonts
    • %Windows%\cursors
    • %Windows%\system32
    • %Windows%\system32\drivers

    (Notes: %Windows% is the Windows folder, which is usually C:\Window.)

  • Registry Subkey:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RestoreList
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{39399744-44FC-AD65-474B-E4DDF-8C7FB97}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{3F90B1B4-58E2-251E-6FFE-4D38C5631A04}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4F20E605-9452-4787-B793-D0204917CA58}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4F20E605-9452-4787-B793-D0204917CA5A}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{9B9A8ADB-8864-4BC4-8AD5-B17DFDBB9F58}
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RestoreList\VideoBase

It creates the following files as markers to identify infected machines:

  • %System%\nsreg1.dat
  • %System%\bssec3.dat
  • %System%\msrdc64.dat

(Notes: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)


This malware stores its payloads in encrypted file storage known as Virtual File Systems (VFS). The payload may be stored in the following files/directories:

  • %System%\config\SystemAudit.Evt
  • %System%\config\SecurityAudit.Evt
  • %System%\config\SystemLog.evt
  • %System%\config\ApplicationLog.evt
  • %Windows%\ime\imesc5\dicts\pintlgbs.imd
  • %Windows%\ime\imesc5\dicts\pintlgbp.imd

(Notes: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions. %Windows% is the Windows folder, which is usually C:\Window.)

Functionalities and Information Stealing

This malware group have the following capabilities:

  • Rootkit
  • Network Port Blocker
  • Network Capture
  • Credential Stealing
  • C&C Communication
  • Cryptography Functions
  • Gather System Information
  • UI manipulation (Screenshot,Log Keystrokes,Click Functionalities)
  • File System Manipulation (Create/Read/Write/Delete)
  • Process and Module Manipulation
  • IIS Web Server Log Theft
  • GSM Activity Log

It connects to the following Command & Control (C&C) servers to send and received information:

  • {BLOCKED}.{BLOCKED}.114.73
  • {BLOCKED}.{BLOCKED}.144.113
  • {BLOCKED}.{BLOCKED}.89.80
  • {BLOCKED}.{BLOCKED}.237.145


Minimum Scan Engine:


Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to clean files detected as TROJ_REGIN.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.