T1053.005: Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution)
Operational Executive Summary
T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution)) is classified under the Persistence tactic within the MITRE ATT&CK framework. Mechanisms that adversaries use to maintain access across reboots, credential changes, and system maintenance, including Registry Run keys, scheduled tasks, and autostart services. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 112 distinct malware families, totaling over 46,099 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1053.005 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1053/005/.
Detection Engineering & Threat Hunting
Detecting Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution) across adjacent network segments.
Cataloged Malware Families Utilizing T1053.005 (112 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution)):
112 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| adposhel | Adware | 8,951 | Adposhel (tracked across the cybersecurity industry as Adware:Win32/Adposhel, PUA:Win32/Adposhel, and Adware.BrowseFox) is an intrusive ad-injection and browser... |
| startsurf | Browser Hijacker | 6,358 | StartSurf (classified by cybersecurity vendors as BrowserModifier:Win32/StartSurf, Adware:Win32/StartSurf, and PUP.Optional.StartSurf) is a pervasive browser hi... |
| dlguide | Pua | 4,733 | DownloadGuide (detected across commercial threat intelligence as PUA:Win32/DownloadGuide, Adware:Win32/DownloadGuide, and Win32/DownloadGuide.Bundler) is a dece... |
| dealply | Adware | 3,976 | DealPly (classified across security products as Adware:Win32/DealPly, Adware.DealPly, and Win32:DealPly) is a sophisticated modular adware and browser modificat... |
| vittalia | Pua | 2,965 | Vittalia (documented across endpoint telemetry as Adware.Vittalia, PUP.Optional.Vittalia, and PUA:Win32/Vittalia) is a persistent adware bundler, browser hijack... |
| qbot | Banking Trojan | 1,758 | QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2... |
| istartsurf | Browser Hijacker | 1,214 | iStartSurf (cataloged across enterprise telemetry as BrowserModifier:Win32/IStartSurf, Adware:Win32/IStartSurf, and PUP.Optional.iStartSurf) is an aggressive br... |
| linkury | Adware | 1,194 | Linkury (cataloged by enterprise security teams as Adware:Win32/Linkury, BrowserModifier:Win32/Linkury, and PUP.Optional.Linkury) is a notorious browser hijacke... |
| icloader | Pua | 1,145 | ICLoader (identified across vendor detection engines as PUA:Win32/ICLoader, Trojan:Win32/ICLoader, and PUP.Optional.InstallCore) is an aggressive software bundl... |
| spigot | Adware | 1,008 | Spigot (documented by Microsoft Defender, Malwarebytes, and Sophos as BrowserModifier:Win32/Spigot, Adware:Win32/Spigot, and PUP.Optional.Spigot) is a widely di... |
| noon | Adware | 926 | Noon (documented across security intelligence solutions as Adware:Win32/Noon and BrowserModifier:Win32/Noon) is an aggressive adware and browser modifier platfo... |
| shipup | Adware | 896 | ShipUp (tracked across threat intelligence feeds as Adware:Win32/ShipUp, Trojan.Win32.ShipUp, and Win32/Shipup) is a deceptive adware engine and background payl... |
| speedingupmypc | Pup | 740 | SpeedingUpMyPC (cataloged by Microsoft Defender as PUA:Win32/SpeedingUpMyPC and tracked by Malwarebytes as PUP.Optional.SpeedingUpMyPC) is a deceptive system op... |
| soft32dl | Pua | 715 | Soft32 Downloader (classified across threat intelligence feeds as PUA:Win32/Soft32Downloader, Adware:Win32/Soft32, and PUP.Optional.Soft32) is a deceptive softw... |
| appster | Adware | 637 | Appster (recognized across cybersecurity solutions as Adware:Win32/Appster, PUA:Win32/Appster, and Adware.Appster) is an aggressive software bundler, monetizati... |
| slimware | Rogueware | 566 | Slimware (documented by Microsoft Defender as PUA:Win32/Slimware and tracked by Malwarebytes as PUP.Optional.SlimwareUtilities) is a deceptive system maintenanc... |
| zamg | Trojan | 527 | Zamg (cataloged across security intelligence as Trojan:Win32/Zamg, Trojan.Mint.Zamg, and Trojan:Win32/Zamg.A!bit) is a covert Windows trojan loader and payload ... |
| softcnapp | Adware | 520 | Softcnapp (tracked across endpoint security engines as PUA:Win32/Softcnapp, Adware:Win32/Softcnapp, and PUP.Optional.Softcnapp) is a rogue application manager, ... |
| kuaizip | Adware | 483 | KuaiZip (cataloged across antimalware engines as PUA:Win32/KuaiZip, Adware:Win32/KuaiZip, and PUP.Optional.KuaiZip, also known as KuaiYa) is a rogue compression... |
| trickbot | Trojan | 466 | TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime histor... |
| fsysna | Trojan | 427 | Trojan:Win32/Fsysna (documented across vendor telemetry as Trojan.Win32.Fsysna, Win32/Fsysna, or Trojan.Win32.FSYSNA) is a sophisticated multi-stage trojan load... |
| winactivator | Pua Tool | 409 | WinActivator (classified across cybersecurity solutions as HackTool:Win32/AutoKMS, HackTool:Win32/WinActivator, and PUA:Win32/KMSpico) is a widespread family of... |
| presenoker | Pua | 406 | PUA:Win32/Presenoker (widely cataloged across Microsoft Defender and endpoint telemetry as Win32/Presenoker or Adware.Presenoker) is an intrusive software bundl... |
| driverpack | Pua | 326 | DriverPack (DriverPack Solution, recognized across endpoint security engines as PUA:Win32/DriverPack, Adware:Win32/DriverPack, and PUP.Optional.DriverPackSoluti... |
| mikey | Adware | 314 | Mikey (cataloged across security software as PUA.Win32.Mikey.AA, Trojan:Win32/Mikey, and PUA:Win32/Mikey!MTB) is a pervasive Potentially Unwanted Application (P... |
| eorezo | Adware | 271 | EoRezo (cataloged across antimalware products as Adware:Win32/EoRezo, PUA:Win32/EORezo, and Adware.EoRezo) is a pervasive French adware platform and software bu... |
| daws | Ransomware | 246 | TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware... |
| pluto | Worm | 209 | Pluto (identified in security intelligence under signatures including Worm:Win32/Pluto, Trojan:Win32/Pluto, W32.Pluto, and Worm.Win32.Pluto) is a hybrid Windows... |
| extenbro | Trojan | 204 | Extenbro (cataloged across security solutions as Trojan:Win32/Extenbro, Trojan:JS/ExtenBro!MTB, TrojanDownloader:Win32/ExtenBro.A, and BrowserModifier:Win32/Ext... |
| kuzitui | Adware | 194 | KuziTui (frequently detected as Adware.KuziTui, PUA:Win32/KuziTui, and Adware:Win32/KuaiZip) is an intrusive adware bundler and Potentially Unwanted Application... |
| hworld | Worm | 166 | Hworld (cataloged across antivirus vendors and threat repositories as Worm:Win32/Hworld.A, W32/HWorld.A, WORM_HWORLD.A, and Backdoor:Win32/Hworld) is a historic... |
| swrort | Backdoor | 161 | Swrort (cataloged across security industry feeds as Backdoor:Win32/Swrort.A, BKDR_SWRORT.A, Trojan:Win32/Swrort, and Trojan.Swrort) is a stealthy Remote Access ... |
| ipamor | Backdoor | 147 | Ipamor (cataloged across security industry feeds as Backdoor:Win32/Ipamor, Trojan:Win32/Ipamor!rfn, Trojan.Win32.IPAMOR, and PE_IPAMOR) is a stealthy remote acc... |
| bsymem | Ransomware | 144 | Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomw... |
| cassiopeia | Backdoor | 137 | Cassiopeia (cataloged across security vendor detection systems as Backdoor:Win32/Cassiopeia, BKDR_CASSIOPEIA.A, and Trojan:Win32/Cassiopeia) is a stealthy Remot... |
| auslogics | Rogueware | 133 | Auslogics (cataloged across security vendors under designations including PUA:Win32/Auslogics, PUP.Optional.Auslogics, and Program:Win32/Auslogics) is a family ... |
| scarsi | Backdoor | 133 | Scarsi (cataloged across security vendors under signatures including Backdoor:Win32/Scarsi, Trojan:Win32/Scarsi, and Win32/Scarsi) is a stealthy Remote Access T... |
| hafen | Backdoor | 120 | Hafen (cataloged across security vendors under detections including Backdoor:Win32/Hafen, BKDR_HAFEN.A, and Trojan:Win32/Hafen) is a stealthy Remote Access Troj... |
| icedid | Banking Trojan | 118 | IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in Sept... |
| tweakbit | Rogueware | 117 | Tweakbit (cataloged across security vendors under detections including PUA:Win32/Tweakbit, PUP.Optional.Tweakbit, and Program:Win32/Tweakbit) is a family of rog... |
| bitmin | Coinminer | 112 | Bitmin (cataloged under Microsoft Defender designations including Trojan:Win32/Bitmin, Trojan:Win32/Bitman, and CoinMiner.Win32.Bitman) is an enduring family of... |
| umbra | Loader | 111 | Umbra (cataloged as Umbra Loader, Trojan:Win32/Umbra, and Backdoor:Win32/Umbra) is an underground modular HTTP botnet loader and malware distribution framework ... |
| apost | Trojan | 109 | APost (consistently cataloged across security research as Trojan:Win32/Apost, Trojan.Win32.APost, and Backdoor:Win32/Apost by Kaspersky, Trend Micro, and Micros... |
| tempedreve | Downloader | 104 | Tempedreve (cataloged across security research as TrojanDownloader:Win32/Tempedreve and Trojan:Win32/Tempedreve) is a dedicated multi-stage trojan downloader an... |
| nisloder | Loader | 103 | Nisloder (cataloged under Microsoft Defender signatures as TrojanDownloader:Win32/Nisloder and Trojan:Win32/Nisloder) is a lightweight modular trojan downloader... |
| nymeria | Downloader | 102 | Nymeria (cataloged across security vendors as TrojanDownloader:Win32/Nymeria, Trojan.Nymeria, and Backdoor:Win32/Nymeria) is a modular Windows trojan downloader... |
| hesv | Trojan | 93 | Hesv (cataloged across security intelligence repositories under identifiers including Trojan:Win32/Hesv, Trojan.Win32.Hesv, and Trojan.MSIL.HESV) is a versatile... |
| cambot | Worm | 89 | CamBot (cataloged across security vendors as Worm:Win32/CamBot, Backdoor:Win32/CamBot, and Trojan:Win32/CamBot) is a hybrid Windows worm and remote access surve... |
| cerbu | Backdoor | 84 | Cerbu (cataloged across security vendors under detections including Backdoor:Win32/Cerbu, Trojan:Win32/Cerbu, and Win32/Cerbu) is a covert Windows remote access... |
| elemental | Adware | 82 | Elemental (cataloged in antivirus telemetry under detections including PUP.Elemental, Trojan:Win32/Elemental, and Win32/Elemental) is an adware packaging framew... |
| buterat | Backdoor | 77 | ButeRAT (cataloged in threat research and security telemetry under signatures including Backdoor:Win32/ButeRAT, Backdoor.Win32.Buterat, and Trojan:Win32/ButeRAT... |
| rozena | Backdoor | 75 | Rozena (cataloged across threat research publications and antimalware engines under detections including Backdoor:Win32/Rozena, Trojan.Win32.ROZENA, and Backdoo... |
| uniblue | Pua | 74 | Uniblue (cataloged across security vendors and antimalware engines under detections including PUA:Win32/Uniblue, Program:Win32/Uniblue, and PUP.Optional.Uniblue... |
| skorik | Trojan | 70 | Skorik (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Skorik and Trojan.Win32.Skorik) is a Windows trojan ... |
| omaneat | Trojan | 66 | Omaneat (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Omaneat, Spyware:Win32/Omaneat!pz, and TrojanSpy:MS... |
| vindor | Trojan | 63 | Vindor (cataloged across security vendors under detections including Trojan:Win32/Vindor, Trojan.Win32.Vindor, and Win32/Vindor) is a multi-stage Windows trojan... |
| shelma | Trojan | 57 | Shelma (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Shelma, Trojan.Win32.Shelma, and Backdoor:Wi... |
| revetrat | Trojan | 50 | RevetRAT (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/RevengeRAT, Trojan:Win32/RevetRAT, and M... |
| systweak | Pua | 23 | Systweak (commonly identified across antimalware engines under designations including PUA:Win32/Systweak, Rogue:Win32/Systweak, Adware:Win32/Systweak, and PUP.O... |
| ytddownloader | Pua | 23 | YTD Downloader (commonly cataloged across endpoint security vendors under signatures including PUA:Win32/YTDDownloader, SoftwareBundler:Win32/YTDVideoDownloader... |
| downloadshield | Pua | 22 | DownloadShield (cataloged under antimalware detections including PUA:Win32/DownloadShield, SoftwareBundler:Win32/DownloadShield, and Adware.DownloadShield) is a... |
| garrun | Trojan | 21 | Garrun (identified in security research telemetry as Trojan:Win32/Garrun, Trojan:Win32/Garrun.A, and Backdoor:Win32/Garrun) is an evasive Windows trojan backdoo... |
| runbooster | Pua | 21 | RunBooster (cataloged under antimalware detections including PUA:Win32/RunBooster, Rogue:Win32/RunBooster, and PUP.Optional.RunBooster) is a deceptive rogue sys... |
| deceptpcclean | Pua | 19 | DeceptPCClean (classified in antimalware telemetry under signatures PUA:Win32/DeceptPCClean, Rogue:Win32/DeceptPCClean, and Program:Win32/DeceptPCClean) is a de... |
| pccleaner | Pua | 17 | PCCleaner (classified in antimalware engines under designations including PUA:Win32/PCCleaner, Program:Win32/PCCleaner, and Rogue:Win32/PCCleaner) is a Potentia... |
| perion | Adware | 17 | Perion (classified across cybersecurity vendors as BrowserModifier:Win32/Perion, Adware:Win32/Perion, and PUA:Win32/Perion) represents a widespread adware, tool... |
| bundlore | Adware | 16 | Bundlore (tracked across security vendors under designations including Adware:OSX/Bundlore, Adware:Win32/Bundlore, OSX.Bundlore, and Shlayer/Bundlore variant) i... |
| vkontaktedj | Adware | 15 | VKontakteDJ (classified across antivirus vendors under designations including PUA:Win32/VKontakteDJ, Adware:Win32/VKontakteDJ, and Program:Win32/VKontakteDJ) is... |
| cloudguard | Pua | 14 | CloudGuard (classified across antivirus vendors under designations including PUA:Win32/CloudGuard and Rogue:Win32/CloudGuard) is a rogue PC optimization and sec... |
| microfake | Scareware | 14 | MicroFake (classified across antimalware engines under designations including Rogue:Win32/MicroFake and Trojan:Win32/MicroFake) is a rogue antivirus and scarewa... |
| onesystemcare | Pua | 14 | OneSystemCare (classified across security vendors as PUA:Win32/OneSystemCare and Program:Win32/OneSystemCare) is a Potentially Unwanted Application and scarewar... |
| optimizer | Pua | 14 | Optimizer (classified across security vendors under designations including PUA:Win32/Optimizer, Program:Win32/Optimizer, and Rogue:Win32/Optimizer) is a rogue P... |
| qqware | Browser Modifier | 14 | QQWare (classified across antivirus vendors under BrowserModifier:Win32/QQWare and Adware:Win32/QQWare) is an intrusive adware and browser modification family t... |
| driverupdate | Pua | 13 | DriverUpdate (classified across security vendors under designations including PUA:Win32/DriverUpdate and Program:Win32/DriverUpdate) is a Potentially Unwanted A... |
| casinoonline | Trojan | 12 | Casinoonline (classified in antivirus detection telemetry under designations including Trojan:Win32/Casinoonline, Trojan.Win32.Casinoonline, and Win32/Casinoonl... |
| centrumloader | Trojan Downloader | 12 | Centrumloader (classified in antivirus detection telemetry under designations including TrojanDownloader:Win32/Centrumloader, TrojanDownloader.Win32.Centrumload... |
| driverupdater | Ransomware | 10 | PUA:Win32/Driverupdater represents a broad category of Potentially Unwanted Programs (PUAs) and Scareware that masquerade as essential system maintenance tools.... |
| idlekms | Ransomware | 10 | HackTool:Win32/Idlekms (and similar tools like KMSPico or AutoKMS) is a software utility designed explicitly for software piracy. It is used to illegally activa... |
| mypcbackup | Advanced Threat | 9 | PUA:Win32/Mypcbackup is a notorious Potentially Unwanted Program (PUA) that operates as highly aggressive 'Scareware'. It masquerades as a legitimate, essential... |
| pckeeper | Advanced Threat | 9 | Rogue:Win32/Pckeeper (also marketed under various names) is a classic example of 'Scareware' and a Rogue PC Optimizer. It is a Potentially Unwanted Program (PUA... |
| regcure | Advanced Threat | 9 | Rogue:Win32/Regcure is one of the most infamous and widely distributed examples of a 'Rogue Registry Cleaner' or Scareware. It is a Potentially Unwanted Program... |
| speedchecker | Advanced Threat | 9 | PUA:Win32/Speedchecker is a Potentially Unwanted Program (PUA) and adware family that masquerades as a 'PC Optimization' or 'Internet Speed Test' utility. Much ... |
| fullscreen | Ransomware | 8 | Adware:Win32/Fullscreen is an aggressive, highly disruptive Potentially Unwanted Program (PUA) and adware family designed to monetize an infected endpoint by fo... |
| pullupdate | Advanced Threat | 7 | Adware:Win32/Pullupdate is a persistent component often associated with larger Potentially Unwanted Program (PUA) or Adware frameworks. Its primary function is ... |
| tsklnk | Trojan | 4 | Trojan:Win32/Tsklnk (Task Link) is a specific classification for malware that abuses legitimate Windows Shortcut files (`.lnk`) and the Windows Task Scheduler t... |
| driverassist | Trojan | 3 | Adware:Win32/Driverassist is a highly aggressive Potentially Unwanted Program (PUP) that masquerades as a legitimate system optimization and driver updating uti... |
| maxdriver | Trojan | 3 | Adware:Win32/Maxdriver (also known as Max Driver Updater) is a highly aggressive Potentially Unwanted Program (PUP) that masquerades as a legitimate system opti... |
| advload | Trojan | 2 | Advload (classified in antivirus detection telemetry under designations including Trojan:Win32/Advload, Trojan.Win32.Advload, and Win32/Advload) is a multi-stag... |
| autocleanpro | Trojan | 2 | Autocleanpro (classified in antivirus detection telemetry under designations including Trojan:Win32/Autocleanpro, Trojan.Win32.Autocleanpro, and Win32/Autoclean... |
| gamaredon | Trojan | 2 | Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (... |
| globalupdate | Advanced Threat | 2 | Adware:Win32/Globalupdate is a highly prevalent classification for a persistent framework used to silently deploy and update Potentially Unwanted Programs (PUPs... |
| jetmedia | Advanced Threat | 2 | Adware:Win32/Jetmedia is a highly persistent adware framework designed to monetize user web traffic by injecting intrusive advertisements, altering browser sear... |
| patchupplus | Advanced Threat | 2 | Adware:Win32/Patchupplus is a classification for a persistent framework used to silently deploy and update Potentially Unwanted Programs (PUPs), adware, and bro... |
| pccleanup | Advanced Threat | 2 | Adware:Win32/Pccleanup is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masquerading as ... |
| progressive | Advanced Threat | 2 | Adware:Win32/Progressive (often associated with 'Progressive Web Apps' abuse or deceptive adware branding) is a classification for unwanted software that aggres... |
| simpleregistrycleaner | Advanced Threat | 2 | Adware:Win32/Simpleregistrycleaner is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masq... |
| updatestar | Advanced Threat | 2 | Adware:Win32/Updatestar is a classification for Potentially Unwanted Programs (PUPs) that masquerade as legitimate software updaters or driver management utilit... |
| zugo | Advanced Threat | 2 | Adware/PUP:Win32/Zugo is a highly aggressive Potentially Unwanted Program (PUP) categorized as Adware or a Browser Hijacker. It is designed to forcibly alter we... |
| commandcam | Trojan | 1 | <h3>Executive Summary</h3> CommandCam is a specialized command-line utility designed to silently capture images from a connected webcam. While it has legitimate... |
| genkmsp | Ransomware | 1 | <h3>Executive Summary</h3> GenKMSP (often associated with KMSPico or AutoKMS) is classified as a "HackTool" or "Riskware." It is a software cracking utility spe... |
| Advanced Threat | 1 | Adware/PUP:Win32/Google (Fake Updates) refers to malware or highly aggressive Potentially Unwanted Programs (PUPs) that deliberately abuse the 'Google' brand na... | |
| gupd | Ransomware | 1 | <h3>Executive Summary</h3> Gupd is a malicious Trojan (often functioning as a downloader or backdoor) that leverages social engineering by masquerading as a leg... |
| kmsactivator | Ransomware | 1 | <h3>Executive Summary</h3> KMS Activator (often seen as AutoKMS or KMSpico) is a widely distributed "HackTool" designed to illegally bypass Microsoft's Key Mana... |
| mycleanpc | Advanced Threat | 1 | Rogueware:Win32/Mycleanpc is a highly visible, classic example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and exto... |
| regcurepro | Advanced Threat | 1 | Rogueware:Win32/Regcurepro is a highly visible, classic example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and ext... |
| securityshield | Trojan | 1 | Rogueware:Win32/Securityshield is a highly visible, classic example of a 'Fake Antivirus' program. It operates entirely on a model of deception and extortion. M... |
| singleclickreg | Advanced Threat | 1 | Adware:Win32/Singleclickreg is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masqueradin... |
| smartpctweaker | Advanced Threat | 1 | Rogueware:Win32/Smartpctweaker is a classic example of a 'Fake Optimizer'. It operates entirely on a model of deception and extortion. Masquerading as a legitim... |
| ssprotect | Advanced Threat | 1 | Rogueware:Win32/Ssprotect is a classic example of a 'Fake Antivirus' or 'Rogueware'. It operates entirely on a model of deception and extortion. Masquerading as... |
| systimizer | Advanced Threat | 1 | Rogueware:Win32/Systimizer is a deceptive application masquerading as a high-end PC optimization and registry cleaning tool. It operates on a model of psycholog... |
| wintaskad | Advanced Threat | 1 | Adware:Win32/Wintaskad represents a family of highly aggressive advertising software (Adware or PUP) that relies on the Windows Task Scheduler (`T1053.005`) for... |
| wisesystemmechanic | Advanced Threat | 1 | Rogueware:Win32/Wisesystemmechanic is a highly visible example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and exto... |