We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Trojan:Win32/Alevaul
Aliases: No associated aliases
Summary
Trojan:Win32/Alevaul is a trojan downloader that compromises Windows devices. Infection typically occurs when the trojan is bundled with other malware or when a user unknowingly downloads it from a compromised website. The primary objective of this threat is to evade detection, to establish unauthorized access and control, or to collect sensitive user information. Its operations are non-destructive by design, relying instead on stealth tactics such as execution delays and network traffic flooding to avoid security software.
The initial confirmed sample of this threat has a creation date of March 27, 2025, indicating its recent emergence. Alevaul presents a moderate risk level due to its core function: retrieving and executing additional malicious scripts from remote servers. Although its code is not encrypted, it is heavily obfuscated and uses subtle launch techniques to remain on a system for extended periods. This persistence is achieved through task scheduling and automation. The malware does not function as a rootkit, meaning it does not employ advanced privilege escalation to hide itself within protected system areas.
- Disconnect the infected device from all networks (both wired and wireless) to sever the command and control connection.
- Activate the viewing of hidden files and folders, then search for and permanently delete any identified malicious files, such as C:\Users\Public\Documents\UpdateOfficeCore.vbs.
- Check Windows Registry hives for unauthorized changes, particularly in proxy settings, and revert any modifications to their default or known-good state.
- Use the Windows Task Manager to identify and terminate any suspicious cmd.exe instances or other processes that may be acting as reverse shells.
- For a confirmed and persistent infection, the most secure action is to completely wipe the hard drive and reinstall the operating system from a clean, trusted source.
- Change all passwords and credentials that were stored on or accessible from the compromised device, as the Alevaul have harvested this data.
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
