Kategorie: Trojan-Ransom
Diese Art von Trojaner ändert Daten auf dem Opfercomputer, sodass das Opfer die Daten nicht mehr verwenden kann, oder verhindert, dass der Computer ordnungsgemäß ausgeführt wird. Sobald die Daten "entführt" wurden (blockiert oder verschlüsselt), erhält der Benutzer eine Lösegeldforderung.Die Lösegeldforderung weist das Opfer an, dem böswilligen Benutzer Geld zu schicken; Nach Erhalt erhält der Cyberkriminelle ein Programm, mit dem das Opfer die Daten wiederherstellen oder die Leistung des Computers wiederherstellen kann.
Mehr Informationen
Plattform: Win32
Win32 ist eine API auf Windows NT-basierten Betriebssystemen (Windows XP, Windows 7 usw.), die die Ausführung von 32-Bit-Anwendungen unterstützt. Eine der am weitesten verbreiteten Programmierplattformen der Welt.Familie: Trojan-Ransom.Win32.Encoder
No family descriptionExamples
441043F8350204CCADEBFC0175A7CE1ATactics and Techniques: Mitre*
TA0006
Credential Access
The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
T1552.008
Chat Messages
Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.
TA0040
Impact
The adversary is trying to manipulate, interrupt, or destroy your systems and data. Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries' goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
T1486
Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.