Class: Trojan
A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read more
Platform: Win64
Win64 is a platform on Windows-based operating systems for execution of 32-/64-bit applications. Win64 programs cannot be launched on 32-bit versions of Windows.Family: Injects
No family descriptionExamples
5FDF4FF5A2F81901DAC7C715FC6B41FA33E3A0318024CF8CC7D3AFF530979817
98D416FD5B1A2CB3089E3FFDF49F0464
0341976305E072C836F6AD6B2FA74494
2E446EFB01C44AFE4D4FBF6DAC2FFBBC
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
T1055.012
Process Hollowing
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.