Clase: Trojan-PSW
Los programas Trojan-PSW están diseñados para robar información de la cuenta de usuario, como inicios de sesión y contraseñas de computadoras infectadas. PSW es un acrónimo de Password Stealing Ware. Cuando se lanza, un troyano PSW busca archivos del sistema que almacenan una gama de datos confidenciales o el registro. Si se encuentran dichos datos, el troyano lo envía a su "maestro". El correo electrónico, FTP, la web (incluidos los datos de una solicitud) u otros métodos pueden usarse para transitar los datos robados. Algunos de estos troyanos también roban información de registro para ciertos programas de software.Más información
Plataforma: Win32
Win32 es una API en sistemas operativos basados en Windows NT (Windows XP, Windows 7, etc.) que admite la ejecución de aplicaciones de 32 bits. Una de las plataformas de programación más extendidas en el mundo.Familia: Trojan-PSW.Win32.Coins
No family descriptionExamples
2F73C24563997AE4DB39018F7ACD4528Tactics and Techniques: Mitre*
TA0011
Command and Control
The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.
T1071.001
Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1102
Web Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.