Clase: Trojan-Downloader
Los programas clasificados como Trojan-Downloader descargan e instalan nuevas versiones de programas maliciosos, incluidos troyanos y AdWare, en las computadoras de las víctimas. Una vez descargados de Internet, los programas se inician o se incluyen en una lista de programas que se ejecutarán automáticamente cuando se inicie el sistema operativo. La información sobre los nombres y las ubicaciones de los programas que se descargan se encuentran en el código troyano, o se descargan del troyano desde un recurso de Internet (generalmente una página web). Este tipo de programa malicioso se utiliza con frecuencia en la infección inicial de visitantes de sitios web que contienen exploits.Más información
Plataforma: Win64
Win64 es una plataforma en sistemas operativos basados en Windows para la ejecución de aplicaciones de 32/64 bits. Los programas Win64 no se pueden iniciar en versiones de 32 bits de Windows.Familia: Trojan-Downloader.Win64.Agent
No family descriptionExamples
E2D549F7DDAEAB9D517FE8F57CA711ACTactics and Techniques: Mitre*
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1055.013
Process Doppelganging
Adversaries may inject malicious code into process via process doppelganging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelganging is a method of executing arbitrary code in the address space of a separate live process.
TA0005
Defense Evasion
The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1055.013
Process Doppelganging
Adversaries may inject malicious code into process via process doppelganging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelganging is a method of executing arbitrary code in the address space of a separate live process.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.