Sınıf: Trojan-Downloader
Trojan-Downloader olarak sınıflandırılan programlar, kurban bilgisayarlarında Truva atları ve AdWare dahil olmak üzere kötü amaçlı programların yeni sürümlerini indirir ve yükler. İnternetten indirildikten sonra, programlar başlatıldığında veya işletim sistemi başlatıldığında otomatik olarak çalışacak programların listesine dahil edilir. İndirilen programların isimleri ve konumları ile ilgili bilgiler Truva kodunda ya da bir internet kaynağından (genellikle bir web sayfasından) Trojan tarafından indirilmektedir. Bu tür kötü amaçlı program, ziyaretçilerin ilk olarak, istismar içeren web sitelerine bulaşmasında kullanılır.Platform: Win32
Win32, 32-bit uygulamaların yürütülmesini destekleyen Windows NT tabanlı işletim sistemlerinde (Windows XP, Windows 7, vb.) Bir API'dir. Dünyanın en yaygın programlama platformlarından biri.Aile: Trojan-Downloader.Win32.Upatre
No family descriptionExamples
459CFCF356A582091321C73A5274C2C935717CE4F65A5F6B716A6F07F6C3C41D
07C527EE4749817D69BBB6D40CEA29C4
9CF5A95725A2FDC43A9FF2E8CC9AD97C
A5EA63AF1EEAB9A80658276D8F798EC5
Tactics and Techniques: Mitre*
TA0002
Execution
The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
T1204.002
Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, and .reg.
TA0007
Discovery
The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1016
System Network Configuration Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.
T1568
Dynamic Resolution
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.