Sınıf: Trojan-PSW
Trojan-PSW programları, virüslü bilgisayarlardan giriş ve şifre gibi kullanıcı hesap bilgilerini çalmak üzere tasarlanmıştır. PSW, Password Stealing Ware'ın bir kısaltmasıdır. Başlatıldığında, bir PSW Truva atı, bir dizi gizli veriyi veya kayıt defterini saklayan sistem dosyalarını arar. Bu tür bir veri bulunursa, Truva atı “master” e gönderir. E-posta, FTP, web (bir talepte bulunan veriler dahil) veya çalınan verilerin aktarılması için başka yöntemler kullanılabilir. Bazı Truva atları da belirli yazılım programları için kayıt bilgilerini çalmaktadır.Platform: MSIL
Ortak Ara Dil (eski adı Microsoft Orta Düzey Dili veya MSIL), Microsoft'un .NET Framework için geliştirdiği bir ara dildir. CIL kodu, Microsoft Visual Studio'da (Visual Basic .NET, Visual C ++, Visual C # ve diğerleri) tüm Microsoft .NET derleyicileri tarafından oluşturulur.Aile: Trojan-PSW.MSIL.Agensla
No family descriptionExamples
504A64FFD9943F9BA21131CC0811BCB0Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1497.002
User Activity Based Checks
Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
TA0007
Discovery
The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
T1497.002
User Activity Based Checks
Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.