Sınıf: Backdoor
Arka kapılar, kötü niyetli kullanıcıların virüslü bir bilgisayar üzerinde uzaktan denetimini sağlamak için tasarlanmıştır. İşlevsel açıdan, Backdoors, yazılım geliştiricileri tarafından tasarlanan ve dağıtılan birçok yönetim sistemine benzer. Bu tür kötü amaçlı programlar, yazarın virüslü bilgisayarda istediği herhangi bir şeyi yapmasını sağlar: dosya gönderme ve alma, dosyaları başlatma veya silme, mesajları görüntüleme, verileri silme, bilgisayarı yeniden başlatma vb. Bu kategorideki programlar sıklıkla kullanılır. Bir grup kurban bilgisayarını birleştirmek ve bir botnet veya zombi ağı oluşturmak için. Bu, kötü niyetli kullanıcılara, daha sonra, suçlu amaçlar için kullanılabilecek bir virüslü bilgisayar ordusu üzerinde merkezi kontrol sağlar. Ağlar üzerinden yayılabilen ve diğer bilgisayarları Net-Worms gibi etkileyebilen bir Back of grubu da var. Aradaki fark, bu Arka Planların otomatik olarak (Net-Solucanlar yaptığı gibi) yayılmamasıdır, ancak onları kontrol eden kötü niyetli kullanıcının özel bir “komutu” üzerinedir.Platform: Win32
Win32, 32-bit uygulamaların yürütülmesini destekleyen Windows NT tabanlı işletim sistemlerinde (Windows XP, Windows 7, vb.) Bir API'dir. Dünyanın en yaygın programlama platformlarından biri.Aile: Backdoor.Win32.Hupigon
No family descriptionExamples
68079D30823B48CC896857534E278CE284D568EBFEC71762ABF19197756C0B0F
D81D2D14571D0C0769EDADA4E69FFEB2
39EDBC27B937269F226146FE305DF840
247CB1B927ECBBE7DEEB79C6B04B852D
Tactics and Techniques: Mitre*
TA0005
Defense Evasion
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
T1055.012
Process Injection: Process Hollowing
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as
This is very similar to Thread Local Storage but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.
Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as
CreateProcess, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Leitch Hollowing)(Citation: Elastic Process Injection July 2017)This is very similar to Thread Local Storage but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.