Classe: Adware
Adware abrange programas projetados para exibir anúncios (geralmente na forma de banners), redirecionar solicitações de pesquisa para sites de publicidade e coletar dados de tipo de marketing sobre o usuário (por exemplo, quais tipos de sites ele / ela visita) para exibir publicidade personalizada em o computador. Além de exibir anúncios e coletar dados, esses tipos de programa geralmente não fazem sua presença no sistema conhecida: não haverá sinais do programa na bandeja do sistema e nenhuma indicação no menu de programa de que os arquivos foram instalados. Muitas vezes, os programas Adware não têm nenhum procedimento de desinstalação e usam tecnologias que fazem fronteira com a tecnologia de vírus para ajudar o programa a penetrar furtivamente no computador e a passar despercebido. Penetração Há duas maneiras principais pelas quais o Adware entra no computador de um usuário: ele é incorporado a alguns programas freeware e shareware de instalação não autorizada no computador de um usuário como resultado de uma visita a um site infectado. A maioria dos programas freeware e shareware para de exibir anúncios depois de terem sido comprados e / ou registrados. Mas esses programas geralmente usam utilitários Adware internos de terceiros e, em alguns casos, esses utilitários permanecem instalados no computador do usuário mesmo depois que os programas são registrados. Além disso, remover o componente Adware, que ainda está sendo usado por um programa para exibir anúncios, pode causar o mau funcionamento do programa. O principal objetivo do Adware se espalhar pelo primeiro método é extrair um tipo de pagamento para o software, mostrando anúncios ao usuário (as partes que fazem os anúncios pagam a agência de publicidade e a agência de publicidade paga ao desenvolvedor Adware). O adware também ajuda a reduzir as despesas dos desenvolvedores de software (a receita da Adware os incentiva a escrever novos programas e melhorar os já existentes) e também ajuda a reduzir os custos para os usuários. As tecnologias de hackers costumam ser usadas quando os componentes de publicidade são instalados no computador de um usuário após uma visita a um site infectado. Por exemplo, o computador pode ser penetrado através de uma vulnerabilidade de navegador e podem ser usados Trojans projetados para furtivamente instalar (Trojan-Downloader ou Trojan-Dropper). Os programas de adware que funcionam dessa maneira geralmente são chamados de sequestradores de navegador (Browser Hijackers). Exibição de anúncios Há duas formas principais de publicidade para o usuário: fazer o download de textos e imagens publicitários para um computador da web ou servidores FTP pertencentes ao anunciante, redirecionando as solicitações de pesquisa do navegador da Internet para sites de publicidade. Em alguns casos, as solicitações de redirecionamento ocorrem somente se a página da Web solicitada pelo usuário não estiver disponível, ou seja, se houver um erro na URL. Coleta de dados Além de exibir anúncios, muitos sistemas de publicidade também coletam dados sobre o computador e o usuário, como: o endereço IP do computador, o sistema operacional e a versão do navegador, uma lista dos sites visitados com mais frequência, consulta outros dados que podem ser usados para conduzir campanhas publicitárias subseqüentes. Nota: é importante não confundir o Adware que coleta dados com programas de spyware do Trojan. A diferença é que o Adware coleta dados com o consentimento do usuário. Se o Adware não notificar o usuário de que está coletando informações, ele será classificado como um programa mal-intencionado (Malware), especificamente coberto pelo comportamento do Cavalo de Tróia.Plataforma: Win32
O Win32 é uma API em sistemas operacionais baseados no Windows NT (Windows XP, Windows 7, etc.) que oferece suporte à execução de aplicativos de 32 bits. Uma das plataformas de programação mais difundidas do mundo.Família: AdWare.Win32.Ad2345
No family descriptionExamples
D38127A3B1114A9A5537E3CC965577D0Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1070.006
Timestomp
Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.
T1205
Traffic Signaling
Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.
T1497.001
System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
T1497.003
Time Based Evasion
Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.
T1622
Debugger Evasion
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
TA0007
Discovery
The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1049
System Network Connections Discovery
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
T1497.001
System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
T1497.003
Time Based Evasion
Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.
T1518
Software Discovery
Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
T1622
Debugger Evasion
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.
T1095
Non-Application Layer Protocol
Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.