poisonivy.exe

What is poisonivy.exe?

poisonivy.exe is the client component of the Poison Ivy Remote Access Trojan (RAT). It establishes a covert backdoor on a compromised machine, enabling an attacker to remotely view screens, capture keystrokes, exfiltrate files, and execute commands. It commonly hides in user directories and communicates with a C2 server.

Poison Ivy uses a modular loader and encrypted C2 traffic to avoid easy detection. It persists via startup tasks or services, spawns multiple components, and can upload/download modules or payloads under attacker control.

Types of Poison Ivy Processes

• Main Client Process: The primary poisonivy.exe instance handling C2 communication and task execution
• Persistence Service: Hidden service or scheduled task used to maintain access across reboots
• Keylogger Module: Component that captures keystrokes and credentials
• Screen Capture Module: Module that takes screenshots or video frames on demand
• Exfiltration/Upload Module: Transfers collected data to the C2 server
• Module Loader: Loads additional plugins or payloads during operation

Is poisonivy.exe Safe?

No, poisonivy.exe is not safe. It is a malicious RAT component designed for covert access and data theft, not a legitimate Windows file.

Is poisonivy.exe a Virus or Malware?

The real poisonivy.exe is malware (RAT). It is not a legitimate system file.

How to Tell if poisonivy.exe is Legitimate or Malware

1. File Location:: Must be in C:\ProgramData\PoisonIvy\poisonivy.exe or C:\Users\Public\Documents\PoisonIvy\poisonivy.exe. Any poisonivy.exe elsewhere is suspicious.
2. Digital Signature:: Right-click the file in Explorer → Properties → Digital Signatures. It should not show a valid signature from a trusted vendor. Absence or a dubious signer indicates malware.
3. Resource Usage:: Unusual persistent CPU or memory spikes, especially when no user action is happening, is a red flag for RAT activity.
4. Behavior:: The file should not launch on system startup in a legitimate user's environment. Any startup persistence warrants further investigation.

Why Is poisonivy.exe Running on My PC?

Poisonivy.exe runs when a system is infected and needs to maintain remote access, persistence, and data exfiltration capabilities for the attacker.

Reasons it's running:

• Active Infected Session: The RAT maintains a live or near-real-time control session with the attacker, enabling commands and data collection.
• Startup Persistence: The malware registers itself to start at boot or user login to survive reboots.
• Background Beaconing: Periodic beacons from the infected host to the command-and-control server solicit commands or exfiltrated data.
• Credential and Data Theft: Keystroke capture, clipboard monitoring, and local data harvesting occur in the background without obvious user interaction.
• Module Loading and Updates: Attackers push new plugins or payloads to extend capabilities or evade detection.

Can I Disable or Remove poisonivy.exe?

Yes, you can disable poisonivy.exe. It's a malicious program; removing it and its persistence mechanisms is essential for system recovery.

How to Stop poisonivy.exe

• End Processes: Open Task Manager (Ctrl+Shift+Esc) → locate poisonivy.exe and related processes, then End Task.
• Stop Startup and Persistence: Open Task Manager → Startup tab and disable any PoisonIvy entries; or use Autoruns to remove registry Run keys and scheduled tasks.
• Run Malware Scan: Perform a full system scan with an up-to-date antivirus/EDR and remove all Poison Ivy components detected.
• Remediate and Monitor: After cleanup, monitor network traffic and run periodic scans to ensure no remnants remain.

Common Problems: RAT Symptoms and Fixes

If poisonivy.exe is active, you may encounter unusual network traffic, unexpected startup entries, or degraded performance.

Common Causes & Solutions

• Unusual outbound connections to unfamiliar domains: Block suspicious domains at the firewall, run a malware cleanup, and review DNS logs for C2 artifacts.
• Multiple hidden processes respawning after termination: Terminate all related processes, remove startup tasks, and scan for additional payloads or plugins.
• Beacons or payloads fail to connect: Check network restrictions, VPN/proxy settings, and ensure no outbound ports are blocked; update EDR rules.
• High CPU/memory while idle: Identify active modules (screen capture, keylogger) and terminate; perform a full cleanup.
• Persistence reappears after cleanup: Search for scheduled tasks, services, and registry Run keys; remove them and perform a cleanup pass.
• Anti-detection and obfuscation: Update security tooling and correlate host indicators with network telemetry to catch obfuscated payloads.

Related Processes