Class: RiskTool
Programs in this category have a number of functions (such as concealing files in the system, hiding windows running applications, terminating active processes, etc.) which can be used with malicious intent. They are, in themselves, not malicious. Unlike programs classified as NetTool, RiskTool programs are designed to operate on the local computer. If a user has installed such a program on his/her computer, or if it was installed by a system administrator, then it does not pose any threat.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: RiskTool.Win32.FlyStudio.dcgg
No family descriptionExamples
78478F7864D48ECAE9B92ECFEB6251CFEC54BF74F44C25CE379E6B225A8FAA38
B8FC143600C87D6048221C0D7C87A3CD
46127909D248C6EDC34308999832CD04
080489C4708EBC7F1D944643A68177ED
Tactics and Techniques: Mitre*
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
* © 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.