Kategorie: Trojan-PSW
Trojan-PSW-Programme dienen dazu, Benutzerkontoinformationen wie Logins und Kennwörter von infizierten Computern zu stehlen. PSW ist eine Abkürzung für Password Stealing Ware.Beim Start durchsucht ein PSW-Trojaner Systemdateien, die eine Reihe von vertraulichen Daten oder die Registrierung speichern. Wenn solche Daten gefunden werden, sendet der Trojaner sie an ihren "Master". E-Mail, FTP, das Web (einschließlich Daten in einer Anfrage) oder andere Methoden können verwendet werden, um die gestohlenen Daten zu übertragen.
Einige solcher Trojaner stehlen auch Registrierungsinformationen für bestimmte Softwareprogramme.
Mehr Informationen
Plattform: Win64
Win64 ist eine Plattform auf Windows-basierten Betriebssystemen für die Ausführung von 32- / 64-Bit-Anwendungen. Win64-Programme können nicht auf 32-Bit-Versionen von Windows gestartet werden.Familie: Trojan-PSW.Win64.Stealer
No family descriptionExamples
10A7864E457A0BD742BD9EA1CEB2C415C0F50EEB62A49EC0EF25D78560758AC3
2150503327AFE075AB6C40A1389F7FE3
F74F21A07003C5744C69909C60E595FC
7E831B63A902AAA4276FEB90BA59869A
Tactics and Techniques: Mitre*
TA0010
Exfiltration
The adversary is trying to steal data.
Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.
Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.
T1567
Exfiltration Over Web Service
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.
Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
T1102.002
Web Service: Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.