Class: RiskTool
Programs in this category have a number of functions (such as concealing files in the system, hiding windows running applications, terminating active processes, etc.) which can be used with malicious intent. They are, in themselves, not malicious. Unlike programs classified as NetTool, RiskTool programs are designed to operate on the local computer. If a user has installed such a program on his/her computer, or if it was installed by a system administrator, then it does not pose any threat.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: FlyStudio
No family descriptionExamples
1AEC6AD46B348634CEB5D5940897047A205AE4717140EB98DF609A57F0D515F1
7AC2D1B84E2D350EE3398FF921B18125
1A84CF26A70CEA2137C77E78D67B18C0
98B55F3A9224803E0F80C93E10371619
Tactics and Techniques: Mitre*
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.