Classe: Trojan-Downloader
Programmes classés comme Trojan-Downloader télécharger et installer de nouvelles versions de programmes malveillants, y compris les chevaux de Troie et AdWare, sur les ordinateurs des victimes. Une fois téléchargés sur Internet, les programmes sont lancés ou inclus dans une liste de programmes qui s'exécuteront automatiquement au démarrage du système d'exploitation. Les informations sur les noms et les emplacements des programmes téléchargés se trouvent dans le code cheval de Troie ou sont téléchargés par le cheval de Troie à partir d'une ressource Internet (généralement une page Web). Ce type de programme malveillant est fréquemment utilisé dans l'infection initiale des visiteurs de sites Web qui contiennent des exploits.Plus d'informations
Plateforme: Win32
Win32 est une API sur les systèmes d'exploitation Windows NT (Windows XP, Windows 7, etc.) qui prend en charge l'exécution des applications 32 bits. L'une des plateformes de programmation les plus répandues au monde.Famille: Trojan-Downloader.Win32.Remus
No family descriptionExamples
FC5D7AA1FE8E77EA708B00AD094A8B96Tactics and Techniques: Mitre*
TA0007
Discovery
The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1033
System Owner/User Discovery
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.