Class: Trojan
A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read more
Platform: WinLNK
A file with the LNK extension is a Windows shortcut to a file, program, or folder.Family: Trojan.Win64.Agent
No family descriptionExamples
E8C4417B439DC9D791976B181E09E83F29C8F16C12BDB098AAF81387FF584EFE
8AE9629A6426CFFBB75D5B1CA9C01DBC
4C5B1A7454F7AB2DE9DE8DB66D25B4F7
7577DA173C8F00EDCB3247E9E476F4AC
Tactics and Techniques: Mitre*
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.