Sınıf: Trojan-Dropper
Trojan-Dropper programları, kurban bilgisayarlarına kodlarının içerdiği kötü amaçlı programları gizlice yüklemek için tasarlanmıştır. Bu tip kötü amaçlı program genellikle bir dizi dosyayı kurbanın sürücüsüne (genellikle Windows dizinine, Windows sistem dizinine, geçici dizine vb.) Kaydeder ve bunları herhangi bir bildirimde bulunmadan başlatır (veya bir arşiv hatasıyla ilgili sahte bildirim ile) eski işletim sistemi sürümü, vb. Bu tür programlar hackerlar tarafından kullanılır: Trojan programlarını ve / veya virüsleri gizlice yüklemek, bilinen kötü amaçlı programları antivirüs çözümleri tarafından algılanmaktan korur; Tüm antivirüs programları bu tip Truva atlarının içindeki tüm bileşenleri tarayamaz.Platform: VBS
Visual Basic Scripting Edition (VBScript), Windows Komut Dosyası Sistemi tarafından yorumlanan bir komut dosyası dilidir. VBScript, Microsoft Windows işletim sistemlerinde komut dosyaları oluşturmak için yaygın olarak kullanılır.Aile: Trojan-Dropper.VBS.Agent
No family descriptionExamples
466A8D2739DD59697BCC6C35FC0BF805989987F5347D5B2C2AACF89427B27EB1
Tactics and Techniques: Mitre*
TA0002
Execution
The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
T1047
Windows Management Instrumentation
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1218.011
Rundll32
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex:
rundll32.exe {DLLname, DLLfunction}). * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.