Class: Trojan
A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: Bsymem
No family descriptionExamples
FF5F609D3ACF8AD0824E6AA823DE63A2FD7455124DF1FA9AE7B2949089F316D7
6E7878826E614D2E5257889FCD5AC926
0F5CC6C66A76C696EB87A07FA5EC6E27
BF03E0D5FC8C50678FABA29D2C320D74
Tactics and Techniques: Mitre*
Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.