Class: Trojan
A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: Trojan.Win64.Agent
No family descriptionExamples
578A5451A4E0E52D9BDEB28E785E89DE75AD6FDDBCE5297DBAFB0422E124B7FE
4C6E54BECFE1D296A03A43549FAC898E
392148001FF677825777D7BC530917A3
94E96A73BD6E48939E19CDF6DC6A79F1
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
T1218.010
Regsvr32
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.