Clase: Backdoor
Las puertas traseras están diseñadas para dar a los usuarios maliciosos el control remoto de una computadora infectada. En términos de funcionalidad, las puertas traseras son similares a muchos sistemas de administración diseñados y distribuidos por los desarrolladores de software. Estos tipos de programas maliciosos hacen posible hacer todo lo que el autor desee en la computadora infectada: enviar y recibir archivos, iniciar archivos o eliminarlos, mostrar mensajes, eliminar datos, reiniciar la computadora, etc. Los programas de esta categoría se utilizan a menudo para unir un grupo de computadoras de víctimas y formar una red zombi o botnet. Esto le da a los usuarios maliciosos control centralizado sobre un ejército de computadoras infectadas que luego pueden ser utilizadas con fines delictivos. También hay un grupo de puertas traseras que son capaces de propagarse a través de redes e infectar a otras computadoras como Net-Worms. La diferencia es que tales Backdoors no se propagan automáticamente (como Net-Worms), sino solo con un "comando" especial del usuario malintencionado que los controla.Más información
Plataforma: Win32
Win32 es una API en sistemas operativos basados en Windows NT (Windows XP, Windows 7, etc.) que admite la ejecución de aplicaciones de 32 bits. Una de las plataformas de programación más extendidas en el mundo.Familia: Backdoor.Win32.Agent
No family descriptionExamples
6D2992B32FC0B317CCAC392350826A24Tactics and Techniques: Mitre*
TA0003
Persistence
The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.
T1547.001
Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1547.001
Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1112
Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.