Regger

Overview

Trojan:Win32/Regger is a persistent trojan characterized by its aggressive and illicit modifications to the Windows Registry. Its primary function is not necessarily direct data theft, but rather **sabotage and system degradation**. It manipulates critical registry keys to disable built-in security features, alter system policies, lower security zones, and pave the way for other, more destructive malware to execute without hindrance.

Understanding Regger
To an end-user, a Regger infection might manifest as a sudden inability to open Task Manager, a disabled Windows Defender, or constantly changing browser homepages. For a system administrator, Regger is a nuisance that attempts to un-harden the endpoint. It functions as an 'environment preparer', ensuring that subsequent malware payloads will not be blocked by OS-level defenses.

Execution and Registry Sabotage Mechanics
Regger is typically distributed as a secondary payload dropped by another downloader or via exploit kits. Upon execution, it does not rely on complex injection; instead, it uses standard Windows APIs (`RegSetValueEx`) to aggressively overwrite values (`T1112`). It specifically targets keys under `HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System` to set `DisableTaskMgr`, `DisableRegistryTools`, and `DisableCMD` to `1` (`T1562.001`). It may also modify `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender` to turn off Real-Time Protection. Furthermore, it alters Internet Explorer Security Zones, effectively lowering the barrier for drive-by downloads. By crippling these administrative and security tools, Regger ensures its own persistence and the survival of companion malware.

Indicators of Compromise & Impact
The impact is a severely compromised and vulnerable operating system. Host-based IoCs are highly specific: EDR alerts triggering on rapid, unauthorized modifications to critical `Policies` and `Windows Defender` registry hives. The user's inability to launch `regedit.exe` or `taskmgr.exe` is a classic symptom. Network IoCs may be minimal, as Regger's primary action is local system modification.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_REGGER {
    meta:
        description = "Detects Regger (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "regger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Regger Activity
id: 2b93ec94f24a23ae2c6b681a846e3937
status: experimental
description: Detects generic indicators of the regger malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*regger*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network, as a Regger infection strongly implies other, more severe malware is being downloaded onto the un-hardened system.
2. Use a trusted, third-party offline registry editor or boot into Safe Mode to reverse the malicious policy changes and re-enable administrative tools.
3. Force a Group Policy update (`gpupdate /force`) if the machine is domain-joined to quickly re-apply corporate security baselines over the malware's changes.
4. Run a full anti-malware scan using an enterprise EDR solution to locate the executable responsible for making the registry changes.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the system is clean just because the registry keys were flipped back; the executable that made the changes must be found and removed.
2. Avoid manually editing the registry without a backup, as incorrect changes can render the Windows OS unbootable.

References & External Analysis

• Search "regger" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Premium
• Revenge
• Regrun
• Bifrose
• Moleboxvs

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/regger.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.