Kategorie: Trojan
Ein bösartiges Programm, das entwickelt wurde, um die Aktivitäten des Benutzers elektronisch auszuspionieren (Tastatureingaben abfangen, Screenshots erstellen, eine Liste aktiver Anwendungen aufzeichnen usw.). Die gesammelten Informationen werden auf verschiedene Arten an den Cyberkriminellen gesendet, einschließlich E-Mail, FTP und HTTP (indem Daten in einer Anfrage gesendet werden).Mehr Informationen
Plattform: Win32
Win32 ist eine API auf Windows NT-basierten Betriebssystemen (Windows XP, Windows 7 usw.), die die Ausführung von 32-Bit-Anwendungen unterstützt. Eine der am weitesten verbreiteten Programmierplattformen der Welt.Familie: Trojan.Win32.Scar
No family descriptionExamples
D8A0D7E6CBC9DDB85529C461D77C919B18DB9FCE3F8A7E3E6236F44D0675AB7A
FBC04DE31BBFAAA4A945A75F1D2E73C8
3E70F3B0E2B93C49B111B23FD38F997A
F7815BF014537B7CEE14DA1784B7564F
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1070.004
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include
del on Windows and rm or unlink on Linux and macOS. * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.