Classe: Packed
Os programas mal-intencionados são freqüentemente compactados - ou compactados - usando uma variedade de métodos combinados com criptografia de arquivos para evitar engenharia reversa do programa e para impedir a análise do comportamento do programa com métodos proativos e heurísticos. Programas antivírus detectam os resultados das ações de empacotadores suspeitos, isto é, itens empacotados. Existem maneiras de impedir que arquivos compactados sejam descompactados: por exemplo, o empacotador não pode decifrar o código totalmente, apenas na medida em que é executado; ou pode descriptografar e iniciar um programa mal-intencionado somente em um determinado dia da semana. Os principais recursos que diferenciam os comportamentos da subclasse Suspicious Packers são o tipo e o número de empacotadores usados no processo de compactação de arquivos.Plataforma: Win32
O Win32 é uma API em sistemas operacionais baseados no Windows NT (Windows XP, Windows 7, etc.) que oferece suporte à execução de aplicativos de 32 bits. Uma das plataformas de programação mais difundidas do mundo.Família: Packed.Win32.Klone
No family descriptionExamples
B0843B672A9D3A65C4C8D4E6B6EE5CC9Tactics and Techniques: Mitre*
TA0007
Discovery
The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1033
System Owner/User Discovery
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.