Class: Rootkit
This type of malicious program is designed to conceal certain objects or activities in the system. Registry keys (those used to automatically launch malicious objects, for example), files, folders, and processes in the memory of an infected computer, as well as malicious network activity, can all be hidden. Rootkits themselves have any malicious payload but in most cases, this type of program is used to prevent malicious programs from being detected and extend the length of time that they run on an infected computer.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: Trojan.Win64.Agent
No family descriptionExamples
483B242E1DBE8A7B2E7B9BC80AD585618561FAF43270BBCF4DFAAF447919D5FC
4EE24A9796408575D1E0A22C47968353
739E679F1031DDC604D566A3D2C3C4B5
9C0066D38F292B20F423CFF358E666F5
Tactics and Techniques: Mitre*
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.