Class: Trojan
A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read more
Platform: Win64
Win64 is a platform on Windows-based operating systems for execution of 32-/64-bit applications. Win64 programs cannot be launched on 32-bit versions of Windows.Family: Injects
No family descriptionExamples
28B78423C6D085E2C01FF94DD755A880EFAC2F67F95D6445ABBF0B258F08AFBE
06410A707063BB503E5994A1B03A3C45
5FDF4FF5A2F81901DAC7C715FC6B41FA
33E3A0318024CF8CC7D3AFF530979817
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
T1055.012
Process Hollowing
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.