Classe: Trojan-Banker
Les programmes Trojan-Banker sont conçus pour dérober des données de compte utilisateur relatives aux systèmes bancaires en ligne, aux systèmes de paiement électronique et aux systèmes de cartes plastiques. Les données sont ensuite transmises à l'utilisateur malveillant contrôlant le cheval de Troie. Le courrier électronique, le protocole FTP, le Web (y compris les données d'une demande) ou d'autres méthodes peuvent être utilisés pour le transit des données volées.Plus d'informations
Plateforme: Win64
Win64 est une plate-forme sur les systèmes d'exploitation Windows pour l'exécution d'applications 32/64 bits. Les programmes Win64 ne peuvent pas être lancés sur des versions 32 bits de Windows.Famille: Trojan-Banker.Win64.CryptoClipper
No family descriptionExamples
C7FEC4AF6E6FC41AFCB0E83750904DC3Tactics and Techniques: Mitre*
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1134
Access Token Manipulation
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1134
Access Token Manipulation
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.