Classe: Trojan-Dropper
Les programmes Trojan-Dropper sont conçus pour installer secrètement des programmes malveillants intégrés dans leur code aux ordinateurs des victimes. Ce type de programme malveillant enregistre généralement une série de fichiers sur le lecteur de la victime (généralement dans le répertoire Windows, le répertoire système Windows, le répertoire temporaire, etc.) et les lance sans aucune notification (ou avec une fausse notification d'erreur d'archivage, version obsolète du système d'exploitation, etc.). De tels programmes sont utilisés par des pirates informatiques pour: installer secrètement des programmes de Troie et / ou des virus empêchent les programmes malveillants connus d'être détectés par des solutions antivirus; tous les programmes antivirus ne sont pas capables d'analyser tous les composants de ce type de chevaux de Troie.Plus d'informations
Plateforme: Win32
Win32 est une API sur les systèmes d'exploitation Windows NT (Windows XP, Windows 7, etc.) qui prend en charge l'exécution des applications 32 bits. L'une des plateformes de programmation les plus répandues au monde.Famille: Trojan-Dropper.Win32.Agent
No family descriptionExamples
6830D0ADCFE35F4B4A037D73B1FB5FCBC87A4A9ACFEC554A20FC84A9114B27A8
BCEC70F9F0768EDEC35A515EA0C598D3
F8D9365D62DF271465E51B01C153BD50
75731DDC9AB0DC68288876AEC2837DB0
Tactics and Techniques: Mitre*
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
T1095
Non-Application Layer Protocol
Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.
ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.
T1571
Non-Standard Port
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.