Kategorie: Trojan-Downloader
Als Trojan-Downloader klassifizierte Programme laden neue Versionen von Schadprogrammen, einschließlich Trojanern und AdWare, auf die Opfercomputer herunter und installieren sie. Nach dem Herunterladen aus dem Internet werden die Programme gestartet oder in eine Liste von Programmen aufgenommen, die beim Hochfahren des Betriebssystems automatisch ausgeführt werden.Informationen über die Namen und Standorte der heruntergeladenen Programme befinden sich im Trojaner-Code oder werden vom Trojaner aus einer Internet-Ressource (normalerweise einer Webseite) heruntergeladen.
Diese Art von bösartigem Programm wird häufig bei der Erstinfektion von Besuchern von Websites verwendet, die Exploits enthalten.
Mehr Informationen
Plattform: Win32
Win32 ist eine API auf Windows NT-basierten Betriebssystemen (Windows XP, Windows 7 usw.), die die Ausführung von 32-Bit-Anwendungen unterstützt. Eine der am weitesten verbreiteten Programmierplattformen der Welt.Familie: Trojan-Downloader.Win32.Agent
No family descriptionExamples
0F9C4796875597679182963551758784980C1924EDAC0A08A565F75994F05664
C9584547FEE2DAE60CC059E6809F44D5
8F063380F265B6E1DE2035480E268D9B
51C4159BA2BB89FA11B001683C11BB96
Tactics and Techniques: Mitre*
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
T1568
Dynamic Resolution
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.