Classe: Trojan-Dropper
Les programmes Trojan-Dropper sont conçus pour installer secrètement des programmes malveillants intégrés dans leur code aux ordinateurs des victimes. Ce type de programme malveillant enregistre généralement une série de fichiers sur le lecteur de la victime (généralement dans le répertoire Windows, le répertoire système Windows, le répertoire temporaire, etc.) et les lance sans aucune notification (ou avec une fausse notification d'erreur d'archivage, version obsolète du système d'exploitation, etc.). De tels programmes sont utilisés par des pirates informatiques pour: installer secrètement des programmes de Troie et / ou des virus empêchent les programmes malveillants connus d'être détectés par des solutions antivirus; tous les programmes antivirus ne sont pas capables d'analyser tous les composants de ce type de chevaux de Troie.Plus d'informations
Plateforme: Win32
Win32 est une API sur les systèmes d'exploitation Windows NT (Windows XP, Windows 7, etc.) qui prend en charge l'exécution des applications 32 bits. L'une des plateformes de programmation les plus répandues au monde.Famille: Trojan-Dropper.Win32.Dapato
No family descriptionExamples
102E8B3AC3708D45A61742371398650B6553100BE48509A0A7BE6C676E6D622A
FC115CD8A3689430AA2E67E86020061A
2F79D66978D4AB7B208686BC80753090
DE669D657A230F212382AD3756128CAB
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1070.004
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include
del on Windows and rm or unlink on Linux and macOS. * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.