Clase: Trojan-Dropper
Los programas Trojan-Dropper están diseñados para instalar en secreto programas maliciosos integrados en su código en las computadoras de las víctimas. Este tipo de programa malicioso generalmente guarda un rango de archivos en el disco de la víctima (generalmente en el directorio de Windows, el directorio del sistema de Windows, el directorio temporal, etc.) y los lanza sin ninguna notificación (o con notificación falsa de un error de archivo, versión obsoleta del sistema operativo, etc.). Tales programas son utilizados por los piratas informáticos para: instalar en secreto programas troyanos y / o virus para evitar que los programas maliciosos conocidos sean detectados por las soluciones antivirus; no todos los programas antivirus son capaces de escanear todos los componentes dentro de este tipo de troyanos.Más información
Plataforma: Win32
Win32 es una API en sistemas operativos basados en Windows NT (Windows XP, Windows 7, etc.) que admite la ejecución de aplicaciones de 32 bits. Una de las plataformas de programación más extendidas en el mundo.Familia: Trojan-Dropper.Win32.Dapato
No family descriptionExamples
24C794367EC4C584DC23F214199FCABAD4A4F666AABEF292631EEFC695762710
4C4AD8C896BA20B6B677A25D97EC2413
A82A6FDD8E058CADF8D5BFA81B1D6522
E00E1037EA6B7052815EFDFF38E38CD4
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1070.004
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include
del on Windows and rm or unlink on Linux and macOS. * © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.