ZxShell

Malware & Tools · ZxShell

· MalwareS0412 · Zararlı Yazılım

Type

malware

Techniques

Used By

3 groups

Platforms

Windows

Description

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)

Tactic Coverage

discovery (7)collection (5)command and control (5)stealth (4)defense impairment (4)privilege escalation (3)execution (3)persistence (3)lateral movement (2)credential access (2)initial access (1)impact (1)

Used By (3 groups)

G0096APT41Wicked Panda, Brass Typhoon G0001AxiomGroup 72 G0027Threat Group-3390Earth Smilodon, TG-3390

Techniques (34)

T1005Data from Local System

collection

T1007System Service Discovery

discovery

T1012Query Registry

discovery

T1021.001Remote Desktop Protocol

lateral movement

T1021.005VNC

lateral movement

T1033System Owner/User Discovery

discovery

T1046Network Service Discovery

References

https://attack.mitre.org/software/S0412 https://blogs.cisco.com/security/talos/opening-zxshell https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

T1056.004Credential API Hooking

collectioncredential access

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1071.002File Transfer Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1090Proxy

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1113Screen Capture

collection

T1125Video Capture

collection

T1134.002Create Process with Token

stealthprivilege escalation

T1136.001Local Account

persistence

T1190Exploit Public-Facing Application

initial access

T1218.011Rundll32

stealth

T1499Endpoint Denial of Service

impact

T1543.003Windows Service

persistenceprivilege escalation

T1569.002Service Execution

execution

T1571Non-Standard Port

command and control

T1685Disable or Modify Tools

defense impairment

T1685.005Clear Windows Event Logs

defense impairment

T1686Disable or Modify System Firewall

defense impairment