zwShell
zwShell is a remote access tool (RAT) written in Delphi that has been used by Night Dragon.[1]
ID: S0350
Type: MALWARE
Platforms: Windows
Version: 1.0
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| Enterprise | T1059 | Command-Line Interface | zwShell can launch command-line shells.[1] |
| Enterprise | T1083 | File and Directory Discovery | zwShell can browse the file system.[1] |
| Enterprise | T1107 | File Deletion | zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.[1] |
| Enterprise | T1112 | Modify Registry | zwShell can modify the Registry.[1] |
| Enterprise | T1050 | New Service | zwShell has established persistence by adding itself as a new service.[1] |
| Enterprise | T1076 | Remote Desktop Protocol | zwShell has used RDP for lateral movement.[1] |
| Enterprise | T1053 | Scheduled Task | zwShell has used SchTasks for execution.[1] |
| Enterprise | T1082 | System Information Discovery | zwShell can obtain the victim PC name and OS version.[1] |
| Enterprise | T1016 | System Network Configuration Discovery | zwShell can obtain the victim IP address.[1] |
| Enterprise | T1033 | System Owner/User Discovery | zwShell can obtain the name of the logged-in user on the victim.[1] |
| Enterprise | T1077 | Windows Admin Shares | zwShell has been copied over network shares to move laterally.[1] |
Groups
Groups that use this software:
Night Dragon