クラス: P2P-Worm
P2Pワームは、ピアツーピアのファイル共有ネットワーク（Kazaa、Grokster、EDonkey、FastTrack、Gnutellaなど）を介して拡散します。これらのワームのほとんどは、比較的簡単な方法で動作します。P2Pネットワークに接続するには、通常、ローカルマシン上のファイル共有ディレクトリに自身をコピーするだけです。 P2Pネットワークはそれ以外の機能を果たします。ファイル検索を実行すると、ファイルをリモートユーザに通知し、感染したコンピュータからファイルをダウンロードできるサービスを提供します。また、特定のファイル共有システムのネットワークプロトコルを模倣し、検索クエリに積極的に応答する、より複雑なP2P-Wormsもあります。 P2P-Wormのコピーがマッチとして提供されます。プラットフォーム: Win32
Win32は、32ビットアプリケーションの実行をサポートするWindows NTベースのオペレーティングシステム（Windows XP、Windows 7など）上のAPIです。世界で最も広く普及しているプログラミングプラットフォームの1つです。ファミリー: P2P-Worm.Win32.Palevo
No family descriptionExamples
8491342833D6BF75EF61DACC14DF9C429D73209E56F0EE30D1612ACC9C5B952A
4042D6047089AF6D4161146107773FFF
A408960D1A45BAFCE945DCBF1CE24185
F93594A3CAE6D7B72C7AF34BBEE3F75E
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036
Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site) Masquerading may also include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site) Masquerading may also include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.
T1036.008
Masquerade File Type
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is
0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.