クラス: Trojan-Banker
Trojan-Bankerプログラムは、オンラインバンキングシステム、電子決済システム、プラスチックカードシステムに関するユーザーアカウントデータを盗むように設計されています。データは、トロイの木馬を制御する悪質なユーザーに送信されます。盗まれたデータを転送するために、電子メール、FTP、ウェブ（要求内のデータを含む）、または他の方法を使用することができる。プラットフォーム: Win64
Win64は、32ビット/ 64ビットアプリケーションを実行するための、Windowsベースのオペレーティングシステム上のプラットフォームです。 32ビットバージョンのWindowsでは、Win64プログラムを起動できません。ファミリー: Trojan-Banker.Win64.Emotet
No family descriptionExamples
E18547DAFE97F5D231AFC33C76B2F0AA3E74FD946782B92EBF4ED70CA82B0045
5D4BFF4A0224DD850C6F628FEC5F3882
3A1F9C66E696B467804266609D7D5F4E
7CD2982A4AB50B54B1673B435EF97C82
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036.004
Masquerading: Masquerade Task or Service
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.
Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
T1070.010
Relocate Malware
Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with File Deletion to cleanup older artifacts.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.