Class: Trojan-Proxy
Trojan-Proxy programs are designed to give malicious users access to a variety of Internet resources via victim computers. These malicious programs are typically used to send out mass spam mailings.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: Horst
No family descriptionExamples
48178B6B9E9739857D2607CA295D2B7398A43ECD31095EBDD75E14D124288014
6C2EA078DAE5E3E778EFC5B9CE6573AB
4827E368B9360A03AECF93D56BC5D793
3C1B928E27D0AAA87CD48979D589CB00
Tactics and Techniques: Mitre*
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process’s memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.