Classe: Trojan-Ransom
Ce type de cheval de Troie modifie les données sur l'ordinateur victime afin que la victime ne puisse plus utiliser les données ou empêche l'ordinateur de fonctionner correctement. Une fois que les données ont été "prises en otage" (bloquées ou cryptées), l'utilisateur recevra une demande de rançon. La demande de rançon indique à la victime d'envoyer de l'argent à l'utilisateur malveillant; à la réception de cela, le cyber-criminel enverra un programme à la victime pour restaurer les données ou restaurer les performances de l'ordinateur.Plus d'informations
Plateforme: Win32
Win32 est une API sur les systèmes d'exploitation Windows NT (Windows XP, Windows 7, etc.) qui prend en charge l'exécution des applications 32 bits. L'une des plateformes de programmation les plus répandues au monde.Famille: Trojan-Ransom.Win32.Encoder
No family descriptionExamples
5F0D0894426564D2CB2823FAFED23CD6Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036.005
Match Legitimate Name or Location
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
T1036.007
Double File Extension
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex:
File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies. * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.