Kategorie: Trojan-Spy
Trojaner-Spy-Programme werden verwendet, um die Aktionen eines Benutzers auszuspionieren (über die Tastatur eingegebene Daten zu verfolgen, Screenshots zu erstellen, eine Liste laufender Anwendungen abzurufen usw.) Die gesammelten Informationen werden dann an den böswilligen Benutzer übertragen, der den Trojaner kontrolliert. E-Mail, FTP, das Web (einschließlich Daten in einer Anfrage) und andere Methoden können verwendet werden, um die Daten zu übertragen.Mehr Informationen
Plattform: Win32
Win32 ist eine API auf Windows NT-basierten Betriebssystemen (Windows XP, Windows 7 usw.), die die Ausführung von 32-Bit-Anwendungen unterstützt. Eine der am weitesten verbreiteten Programmierplattformen der Welt.Familie: Trojan-Spy.Win32.Bobik
No family descriptionExamples
7A3514A407FBE9E6EF01303DB256335BTactics and Techniques: Mitre*
TA0009
Collection
The adversary is trying to gather data of interest to their goal.
Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.
Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the data. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.
T1113
Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as
CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.