Kategorie: HackTool
HackTool-Programme werden verwendet, um neue Benutzer in der Liste der zulässigen Systembesucher zu erstellen und Informationen aus Systemprotokollen zu löschen, um die Anwesenheit des böswilligen Benutzers auf dem System zu verbergen. Diese Programme werden auch verwendet, um Netzwerkpakete zu analysieren und zu sammeln, um bestimmte bösartige Aktionen auszuführen.Schädliche Benutzer setzen HackTool-Programme ein, wenn sie Angriffe auf lokale oder Remote-Computer einrichten.
Mehr Informationen
Plattform: Win64
Win64 ist eine Plattform auf Windows-basierten Betriebssystemen für die Ausführung von 32- / 64-Bit-Anwendungen. Win64-Programme können nicht auf 32-Bit-Versionen von Windows gestartet werden.Familie: HackTool.Win64.Agent
No family descriptionExamples
B600E417F9756F7895A3C6FFA14660F4Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1070
Indicator Removal
Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
TA0040
Impact
The adversary is trying to manipulate, interrupt, or destroy your systems and data. Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries' goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
T1531
Account Access Removal
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.