MITRE ATT&CKsoftware (malware)

S0350 zwShell

Published 2019-01-30 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
2.0
Created
2019-01-30

Description

zwShell is a remote access tool (RAT) written in Delphi that has been seen in the wild since the spring of 2010 and used by threat actors during Night Dragon.

Related

Uses · MITRE ATT&CK (11)

  • T1059.003 Windows Command Shell sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1070.004 File Deletion sub-technique
  • T1543.003 Windows Service sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (1)

  • C0002 Night Dragon campaign

References