MITRE ATT&CKsoftware (malware)
S0412 ZxShell
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Sensocode
- Version
- 1.2
- Created
- 2019-09-24
Description
ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.
Related
Uses · MITRE ATT&CK (34)
- T1685 Disable or Modify Tools technique
- T1685.005 Clear Windows Event Logs sub-technique
- T1686 Disable or Modify System Firewall technique
- T1071.001 Web Protocols sub-technique
- T1071.002 File Transfer Protocols sub-technique
- T1571 Non-Standard Port technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1134.002 Create Process with Token sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.005 VNC sub-technique
- T1056.001 Keylogging sub-technique
- T1056.004 Credential API Hooking sub-technique
- T1070.004 File Deletion sub-technique
- T1136.001 Local Account sub-technique
- T1218.011 Rundll32 sub-technique
- T1543.003 Windows Service sub-technique
- T1055.001 Dynamic-link Library Injection sub-technique
- T1499 Endpoint Denial of Service technique
- T1190 Exploit Public-Facing Application technique
- T1005 Data from Local System technique
- T1007 System Service Discovery technique
- T1012 Query Registry technique
- T1033 System Owner/User Discovery technique
- T1046 Network Service Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1090 Proxy technique
- T1105 Ingress Tool Transfer technique
References
- https://blogs.cisco.com/security/talos/opening-zxshell Talos ZxShell Oct 2014
- https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf FireEye APT41 Aug 2019