ATT&CKcon 4.0 will be held on Oct 24-25 in McLean, VA. Click here for more details and to register.
SOFTWARE
Zeroaccess
Zeroaccess is a kernel-mode Rootkit that attempts to add victims to the ZeroAccess botnet, often for monetary gain. [1]
ID: S0027
ⓘ
Type: MALWARE
Version: 1.0
Created: 31 May 2017
Last Modified: 17 October 2018
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1564 | .004 | Hide Artifacts: NTFS File Attributes |
Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.[2] |
| Enterprise | T1014 | Rootkit |
Zeroaccess is a kernel-mode rootkit.[1] |
|
References
×