Classe: Rootkit
Esse tipo de programa malicioso é projetado para ocultar certos objetos ou atividades no sistema. Chaves de registro (aquelas usadas para iniciar automaticamente objetos maliciosos, por exemplo), arquivos, pastas e processos na memória de um computador infectado, bem como atividade de rede maliciosa, podem ser ocultadas. Os próprios rootkits têm alguma carga maliciosa, mas na maioria dos casos, esse tipo de programa é usado para impedir que programas mal-intencionados sejam detectados e estender o tempo que eles são executados em um computador infectado.Plataforma: Win64
O Win64 é uma plataforma em sistemas operacionais baseados no Windows para execução de aplicativos de 32/64 bits. Programas Win64 não podem ser iniciados em versões de 32 bits do Windows.Família: Rootkit.Win64.Agent
No family descriptionExamples
22F11F843A38131FC76FBA5A1AECA66ATactics and Techniques: Mitre*
TA0003
Persistence
The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.
T1543.003
Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1543.003
Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.