クラス: Trojan
ユーザーの活動を電子的に偵察する（キーボード入力の傍受、スクリーンショットの取得、アクティブなアプリケーションのリストの取得など）ために設計された悪質なプログラム。収集された情報は、電子メール、FTP、およびHTTP（リクエストでデータを送信すること）を含むさまざまな手段によってサイバー犯罪者に送信されます。プラットフォーム: Win32
Win32は、32ビットアプリケーションの実行をサポートするWindows NTベースのオペレーティングシステム（Windows XP、Windows 7など）上のAPIです。世界で最も広く普及しているプログラミングプラットフォームの1つです。ファミリー: Trojan.Win32.Cosmu
No family descriptionExamples
132C80147B6C89FD5D244610F8DFCB40E673EBC1E1B3DC04D2EAD0B77A90DD02
43A76772F898DED514087DF34B3AE10F
A8410D18B906C1F5FCACCD1DEBB2E26C
06D6E0BEBF6F4F590639B02D4BE8860C
Tactics and Techniques: Mitre*
TA0040
Impact
The adversary is trying to manipulate, interrupt, or destroy your systems and data.
Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
T1491.001
Defacement: Internal Defacement
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.