Kaspersky Threats — P2P-Worm.Win32.Palevo.hyka

Classe: P2P-Worm

Les vers P2P se propagent via des réseaux de partage de fichiers peer-to-peer (tels que Kazaa, Grokster, EDonkey, FastTrack, Gnutella, etc.). La plupart de ces vers fonctionnent de manière relativement simple: pour accéder à un réseau P2P, tout ce que le ver doit faire est de se copier dans le répertoire de partage de fichiers, qui se trouve généralement sur une machine locale. Le réseau P2P fait le reste: lorsqu'une recherche de fichier est effectuée, il informe les utilisateurs distants du fichier et fournit des services permettant de télécharger le fichier depuis l'ordinateur infecté. Il existe également des vers P2P plus complexes qui imitent le protocole réseau d'un système de partage de fichiers spécifique et répondent positivement aux requêtes de recherche. une copie du ver P2P est offerte en correspondance.

Plus d'informations

Plateforme: Win32

Win32 est une API sur les systèmes d'exploitation Windows NT (Windows XP, Windows 7, etc.) qui prend en charge l'exécution des applications 32 bits. L'une des plateformes de programmation les plus répandues au monde.

Famille: P2P-Worm.Win32.Palevo

No family description

Examples

CCE8F29F4BAFA8A4A47487A3E2AEA1EE

Tactics and Techniques: Mitre*

TA0005

Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

T1497.003

Time Based Evasion

Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.

TA0006

Credential Access

The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.

T1552.008

Chat Messages

Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.

TA0007

Discovery

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

T1497.003

Time Based Evasion