Caminho
- ID
- S9016
- Type
- Malware
- Associated names
- VMDetectLoader
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Caminho is a downloader that has been used by threat actors since at least 2025 to deliver various strains of malware such as XWorm.[1]
Techniques used (6)
- T1027.001 Binary Padding
- T1027.013 Encrypted/Encoded File
- T1055.012 Process Hollowing
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1140 Deobfuscate/Decode Files or Information