The sub-techniques beta is now live! Read the release blog post for more info.
SOFTWARE
SOFTWARE
1-9
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Y-Z
  1. Home
  2. Software
  3. Zeroaccess

Zeroaccess

Zeroaccess is a kernel-mode Rootkit that attempts to add victims to the ZeroAccess botnet, often for monetary gain. [1]

ID: S0027
Associated Software: Trojan.Zeroaccess
Type: MALWARE
Platforms: Windows
Version: 1.0
Created: 31 May 2017
Last Modified: 17 October 2018
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1096 NTFS File Attributes

Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.[2]
Enterprise T1014 Rootkit

Zeroaccess is a kernel-mode rootkit.[1]

References

  1. Wyke, J. (2012, April). ZeroAccess. Retrieved July 18, 2016.
  1. Ciubotariu, M. (2014, January 23). Trojan.Zeroaccess.C Hidden in NTFS EA. Retrieved December 2, 2014.