● Malware

zwShell

zwShell is a remote access tool (RAT) written in Delphi that has been seen in the wild since the spring of 2010 and used by threat actors during Night Dragon.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

11 relationships

T1053.005: Scheduled Task

source

T1033: System Owner/User Discovery

source

T1543.003: Windows Service

source

T1082: System Information Discovery

source

T1021.002: SMB/Windows Admin Shares

source

T1112: Modify Registry

source

T1016: System Network Configuration Discovery

source

T1083: File and Directory Discovery

source

T1059.003: Windows Command Shell

source

T1070.004: File Deletion

source

T1021.001: Remote Desktop Protocol

source