Kategorie: Trojan-Downloader
Als Trojan-Downloader klassifizierte Programme laden neue Versionen von Schadprogrammen, einschließlich Trojanern und AdWare, auf die Opfercomputer herunter und installieren sie. Nach dem Herunterladen aus dem Internet werden die Programme gestartet oder in eine Liste von Programmen aufgenommen, die beim Hochfahren des Betriebssystems automatisch ausgeführt werden.Informationen über die Namen und Standorte der heruntergeladenen Programme befinden sich im Trojaner-Code oder werden vom Trojaner aus einer Internet-Ressource (normalerweise einer Webseite) heruntergeladen.
Diese Art von bösartigem Programm wird häufig bei der Erstinfektion von Besuchern von Websites verwendet, die Exploits enthalten.
Mehr Informationen
Plattform: Win32
Win32 ist eine API auf Windows NT-basierten Betriebssystemen (Windows XP, Windows 7 usw.), die die Ausführung von 32-Bit-Anwendungen unterstützt. Eine der am weitesten verbreiteten Programmierplattformen der Welt.Familie: Trojan-Downloader.Win32.Agent
No family descriptionExamples
CD5202C3E9876C7586AFA322AF51350A4E05C19B2F2ECB7E1C51F1B621E1CFDC
D04C92C7E5BE76A9FEEBD40C30CEB77F
43FED02C95AD5C831984F87B9DBD8A47
183EE232919F2F3E73F31AE343CA7ABB
Tactics and Techniques: Mitre*
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
T1102
Web Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.