MITRE ATT&CKsoftware (malware)
S0086 ZLib
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.2
- Created
- 2017-05-31
Description
ZLib is a full-featured backdoor that was used as a second-stage implant during Operation Dust Storm since at least 2014. ZLib is malware and should not be confused with the legitimate compression library from which its name is derived.
Related
Uses · MITRE ATT&CK (11)
- T1071.001 Web Protocols sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1560.002 Archive via Library sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1543.003 Windows Service sub-technique
- T1007 System Service Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1113 Screen Capture technique
Referenced by MITRE ATT&CK · uses (1)
- C0016 Operation Dust Storm campaign