Class: Trojan-Downloader
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up. Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page). This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: Stantinko
No family descriptionExamples
ACE82CD0040E62064F015E33FC8C257A4E07FC6225531C0CDA297C3F47009CD4
1A24A49F481D2A656499D740863C0E16
F6CE84A546A45429ED2FE367431DEFCE
DD073A9962BA82F6FB32DAD7C5BB8866
Tactics and Techniques: Mitre*
TA0007
Discovery
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.
T1007
System Service Discovery
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.