Classe: Trojan-PSW
Les programmes Trojan-PSW sont conçus pour dérober des informations de compte d'utilisateur telles que les connexions et les mots de passe des ordinateurs infectés. PSW est un acronyme de Password Stealing Ware. Lorsqu'il est lancé, un cheval de Troie PSW recherche les fichiers système qui stockent une série de données confidentielles ou le registre. Si de telles données sont trouvées, le cheval de Troie l'envoie à son «maître». L'email, le ftp, le Web (y compris les données dans une demande), ou d'autres méthodes peuvent être utilisés pour passer les données volées. Certains de ces chevaux de Troie volent également des informations d'enregistrement pour certains logiciels.Plus d'informations
Plateforme: MSIL
Le Common Intermediate Language (anciennement connu sous le nom de Microsoft Intermediate Language, ou MSIL) est un langage intermédiaire développé par Microsoft pour le .NET Framework. Le code CIL est généré par tous les compilateurs Microsoft .NET dans Microsoft Visual Studio (Visual Basic .NET, Visual C ++, Visual C # et autres).Famille: Trojan-PSW.MSIL.Agensla
No family descriptionExamples
4510308CF5F71AE30219F5320C863DC4Tactics and Techniques: Mitre*
TA0006
Credential Access
The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
T1056.001
Keylogging
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.
T1071.001
Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.