Třída: Trojan-Spy
Programy Trojan-Spy se používají k špehování akcí uživatele (sledování dat zadaných klávesnicí, vytváření snímků na obrazovce, načtení seznamu běžících aplikací apod.) Získané informace jsou poté předávány škodlivému uživateli, který kontroluje Trojan. K přenosu dat lze použít e-mail, FTP, web (včetně dat v žádosti) a další metody.Platfoma: Win32
Win32 je rozhraní API v operačních systémech Windows NT (Windows XP, Windows 7 atd.), Které podporují provádění 32bitových aplikací. Jedna z nejrozšířenějších programovacích platforem na světě.Family: Trojan-Spy.Win32.Bobik
No family descriptionExamples
6C876BB453D228A82C09A3301145851FD4EE5429496940471A5E0570D6287EFB
EC47130AABE7639FA7969D5098B059F3
E4DEC2F6E23A089C6B83778B2171F5AF
272F65017295CB410FF3E8E590710C7E
Tactics and Techniques: Mitre*
TA0040
Impact
The adversary is trying to manipulate, interrupt, or destroy your systems and data.
Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
T1491.001
Defacement: Internal Defacement
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.