Indigorose

Overview

Executive Summary

Infection Vector and Technical Capabilities

• File Extraction and Execution: The compiled executable acts as a sophisticated "dropper" or binder. It silently extracts embedded files (the actual malware payload, such as a RAT or info-stealer) to temporary directories (e.g., `%TEMP%`).
• Scripted Automation: The attacker utilizes the legitimate scripting capabilities of AutoPlay Media Studio (Lua-based) to automate the execution of the extracted malware, modify registry keys, or even disable specific security services before the payload runs.
• Evasion by Association: Because the outer executable is compiled by a legitimate commercial tool, it often bypasses simplistic antivirus heuristics that are looking for standard malware packing techniques (like UPX).

Threat Assessment

Incident Response and Remediation

• Do Not Execute: If a suspicious IndigoRose executable (often disguised as a document or a "Setup.exe") is discovered, do not run it. Isolate the file immediately.
• Forensic Unpacking: Security analysts must use specialized tools to unpack the IndigoRose container and analyze the embedded files and the internal Lua scripts to determine the true nature of the payload.
• Network Isolation: If the file was inadvertently executed, immediately isolate the endpoint and perform a deep forensic scan to locate and eradicate the extracted secondary malware.

Known aliases

Threat reports may refer to this family under multiple names:

• Riskware.IndigoRose
• Dropper.AutoPlay
• Win32/AutoPlay.Suspicious

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1204.002 T1027

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_INDIGOROSE {
    meta:
        description = "Detects Indigorose (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "indigorose" ascii wide nocase
        $s2 = "riskware.indigorose" ascii wide nocase
        $s3 = "dropper.autoplay" ascii wide nocase
        $s4 = "win32/autoplay.suspicious" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Indigorose Activity
id: 360a18cbaeeb88232fd6dcdeb1f41674
status: experimental
description: Detects generic indicators of the indigorose malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*indigorose*"
            - "*riskware.indigorose*"
            - "*dropper.autoplay*"
            - "*win32/autoplay.suspicious*"
    condition: selection
level: medium

References & External Analysis

• Search "indigorose" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Cardspy
• Perflogger
• Peflog
• Negasteal
• Injeber

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/indigorose.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.