Classe: Trojan-Dropper
Os programas do Trojan-Dropper são projetados para instalar secretamente programas maliciosos embutidos em seus códigos nos computadores das vítimas. Esse tipo de programa malicioso geralmente salva vários arquivos na unidade da vítima (geralmente no diretório do Windows, no diretório de sistema do Windows, no diretório temporário, etc.) e os lança sem qualquer notificação (ou com notificação falsa de um erro de arquivamento). versão desatualizada do sistema operacional, etc.). Tais programas são usados por hackers para: instalar secretamente programas de Tróia e / ou vírus que protejam programas maliciosos conhecidos de serem detectados por soluções de antivírus; nem todos os programas antivírus são capazes de escanear todos os componentes dentro desse tipo de trojans.Plataforma: Win32
O Win32 é uma API em sistemas operacionais baseados no Windows NT (Windows XP, Windows 7, etc.) que oferece suporte à execução de aplicativos de 32 bits. Uma das plataformas de programação mais difundidas do mundo.Família: Trojan-Dropper.Win32.TDSS
No family descriptionExamples
4C5D4C454AD5BDE653F6D7E589F762C4Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036
Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
T1070.010
Relocate Malware
Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with File Deletion to cleanup older artifacts.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.