Třída: Trojan-Ransom
Tento typ trojského koně modifikuje data na počítači poškozeného, takže oběť již nemůže používat data nebo zabraňuje správnému fungování počítače. Jakmile budou data "rukojmím" (zablokována nebo zašifrována), uživatel obdrží požadavek na výkupné.Požadavek výkupného žádá oběť, aby poslala škodlivé uživatelské peníze; po obdržení tohoto kroku pošle počítačový zločinec poškozenému program obnovení dat nebo obnovení výkonu počítače.
Platfoma: Win32
Win32 je rozhraní API v operačních systémech Windows NT (Windows XP, Windows 7 atd.), Které podporují provádění 32bitových aplikací. Jedna z nejrozšířenějších programovacích platforem na světě.Family: Trojan-Ransom.Win32.Encoder
No family descriptionExamples
5F0D0894426564D2CB2823FAFED23CD6Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036.005
Match Legitimate Name or Location
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
T1036.007
Double File Extension
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex:
File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies. * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.