クラス: Trojan-Downloader
Trojan-Downloaderとして分類されたプログラムは、トロイの木馬やAdWareを含む悪意のあるプログラムの新しいバージョンをダウンロードし、犠牲PCにインストールします。インターネットからダウンロードされると、プログラムは起動され、オペレーティングシステムの起動時に自動的に実行されるプログラムのリストに含まれます。ダウンロードされるプログラムの名前と場所に関する情報は、トロイの木馬のコードに含まれているか、インターネットリソース（通常はWebページ）からトロイの木馬によってダウンロードされます。この種の悪意のあるプログラムは、悪用を含むWebサイトへの訪問者の初期感染に頻繁に使用されます。プラットフォーム: Win32
Win32は、32ビットアプリケーションの実行をサポートするWindows NTベースのオペレーティングシステム（Windows XP、Windows 7など）上のAPIです。世界で最も広く普及しているプログラミングプラットフォームの1つです。ファミリー: Trojan-Downloader.Win32.Dedok
No family descriptionExamples
51BB9C9143A5259E135808D2A36458ABB06A890C5992C6D7C62B7EB276365DA3
B094C83FCBB6B303C0D1623788C870E9
4A109C7D9A572503DB813E2FAC5C5514
70CEB8F88FF42AA597A7B9DB347FA323
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036.005
Masquerading: Match Legitimate Name or Location
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
Adversaries may also use the same icon of the file they are trying to mimic.
Adversaries may also use the same icon of the file they are trying to mimic.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.