Class: Trojan
A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: Trojan.Multi.Runner
No family descriptionExamples
B5D1AE27ADCC3DF2B2CA18EFF8CF261F120E3733E167FCABDFD8194B3C49560B
E57051E6508ABA91D976E6174392EE4F
F20D4DC87E248363988DE323E0D9F366
E7AC49BA168803FB0AD27DAECF296E72
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code
T1218.005
Mshta
Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.