Classe: Trojan-Banker
Les programmes Trojan-Banker sont conçus pour dérober des données de compte utilisateur relatives aux systèmes bancaires en ligne, aux systèmes de paiement électronique et aux systèmes de cartes plastiques. Les données sont ensuite transmises à l'utilisateur malveillant contrôlant le cheval de Troie. Le courrier électronique, le protocole FTP, le Web (y compris les données d'une demande) ou d'autres méthodes peuvent être utilisés pour le transit des données volées.Plus d'informations
Plateforme: Win32
Win32 est une API sur les systèmes d'exploitation Windows NT (Windows XP, Windows 7, etc.) qui prend en charge l'exécution des applications 32 bits. L'une des plateformes de programmation les plus répandues au monde.Famille: Trojan-Banker.Win32.ChePro
No family descriptionExamples
FA2F258D33B083236D7EC9BB354A9B7FC52612E54DC448BA5E28FB4D12116A6C
460E299EEC00B03956D010DF50704556
5E689BF29E64E8C5FE447EA58BD3F79A
F37F88F2CDBE18612917AD2B2103CD82
Tactics and Techniques: Mitre*
TA0007
Discovery
The adversary is trying to figure out your environment.
Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1016
System Network Configuration Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g.
Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g.
show ip route, show ip interface).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion )Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.