ZeroT
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1548 | .002 | Abuse Elevation Control Mechanism: Bypass User Account Control |
Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.(Citation: Proofpoint ZeroT Feb 2017) |
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
ZeroT has used HTTP for C2.(Citation: Proofpoint TA459 April 2017)(Citation: Proofpoint ZeroT Feb 2017) |
| Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.(Citation: Proofpoint ZeroT Feb 2017) |
| Enterprise | T1001 | .002 | Data Obfuscation: Steganography |
ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.(Citation: Proofpoint TA459 April 2017)(Citation: Proofpoint ZeroT Feb 2017) |
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
ZeroT has used RC4 to encrypt C2 traffic.(Citation: Proofpoint TA459 April 2017)(Citation: Proofpoint ZeroT Feb 2017) |
| Enterprise | T1574 | .002 | Hijack Execution Flow: DLL Side-Loading |
ZeroT has used DLL side-loading to load malicious payloads.(Citation: Proofpoint TA459 April 2017)(Citation: Proofpoint ZeroT Feb 2017) |
| Enterprise | T1027 | .001 | Obfuscated Files or Information: Binary Padding |
ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.(Citation: Proofpoint ZeroT Feb 2017) |
| .002 | Obfuscated Files or Information: Software Packing |
Some ZeroT DLL files have been packed with UPX.(Citation: Proofpoint ZeroT Feb 2017) |
||
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.