Backdoor:Win32/Khalesi is a highly capable, modular Remote Access Trojan (RAT) and information stealer utilized by cybercriminals to establish deep persistence and exfiltrate sensitive data.
Understanding Khalesi
To the victim, Khalesi provides zero indication of infection. For threat intelligence analysts, Khalesi is a dangerous, multi-functional tool. It is designed to act as a silent observer, harvesting keystrokes, capturing screenshots, and extracting credentials from web browsers and email clients before securely transmitting them back to the attacker's infrastructure.
Execution and Evasion Strategies
Khalesi is distributed through targeted spam campaigns containing malicious attachments or dropped via exploit kits. Upon execution, it copies itself into the %AppData% directory, often masquerading as a legitimate Windows executable. It achieves persistence by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. Khalesi utilizes advanced code injection, hollowing out legitimate processes (like explorer.exe) to hide its activities. The C2 communications are heavily encrypted and often utilize Domain Generation Algorithms (DGA) to evade network-level blocking.
Indicators of Compromise & Impact
The impact of Khalesi is a severe breach of confidentiality. The attacker gains full interactive control over the endpoint. Incident responders should monitor for anomalous outbound TCP traffic, particularly to known dynamic DNS providers. The presence of encrypted log files (often .dat or .log) in the user's profile directory, containing captured keystrokes and screenshots, is a strong indicator. Memory forensics is required to extract the unencrypted Khalesi payload and C2 configuration from injected processes.
Observed techniques used by this family, mapped to the MITRE ATT&CK framework:
| Technique | Name | Tactic |
|---|---|---|
T1056.001 | Input Capture: Keylogging | Collection |
T1113 | Screen Capture | Collection |
T1055.012 | Process Injection: Process Hollowing | Defense Evasion |
T1568.002 | Dynamic Resolution: Domain Generation Algorithms | Command and Control |
T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Persistence |
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
rule MALWARE_WIN_KHALESI {
meta:
description = "Detects Khalesi (infostealer)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "khalesi" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}title: Suspicious Khalesi Activity
id: 42cd929d8cc985ce920bdc264daad9fd
status: experimental
description: Detects generic indicators of the khalesi malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*khalesi*"
condition: selection
level: mediumOrdered checklist for responders. Adapt to your environment and engage professional support for active incidents.
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
Explore other malware families in the same category:
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/khalesi.json
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.