Třída: Backdoor
Zadní stěny jsou navrženy tak, aby poskytovaly škodlivým uživatelům vzdálený přístup k infikovanému počítači. Pokud jde o funkčnost, Backdoors jsou podobné mnoha administrativním systémům navrženým a distribuovaným vývojáři softwaru.Tyto typy škodlivých programů umožňují dělat cokoliv, co autor chce na napadeném počítači: odesílat a přijímat soubory, spouštět soubory nebo je smazat, zobrazovat zprávy, mazat data, restartovat počítač atd.
Programy v této kategorii se často používají k sjednocení skupiny obětí počítačů a vytvoření sítě botnet nebo zombie. To dává zlomyslným uživatelům centralizovanou kontrolu nad armádou infikovaných počítačů, které pak mohou být použity pro kriminální účely.
Existuje také skupina Backdoors, která je schopna šíření prostřednictvím sítí a infikování jiných počítačů jako Net-Worms. Rozdíl je v tom, že takové Backdoors se nerozšířují automaticky (jak to dělá Net-Worms), ale pouze na speciální "příkaz" od škodlivého uživatele, který je ovládá.
Platfoma: Win32
Win32 je rozhraní API v operačních systémech Windows NT (Windows XP, Windows 7 atd.), Které podporují provádění 32bitových aplikací. Jedna z nejrozšířenějších programovacích platforem na světě.Family: Backdoor.Win32.Plite
No family descriptionExamples
C680996137866F1D213B64DA11C3164A3B04D0E7BA8CD166159294835E40E737
68C10DC2DC724A9258502D767A766143
03FDF4058CA28A1E35C78CAAD848BEAB
958B8F6D0525D3DF6D5E134F69EDFC3E
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1036
Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site) Masquerading may also include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site) Masquerading may also include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.
T1070.004
File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.