Search/ZxShell
● Malware

ZxShell

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
37 relationships
T1021.005: VNC
source
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1218.011: Rundll32
source
T1056.001: Keylogging
source
T1543.003: Windows Service
source
T1007: System Service Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1190: Exploit Public-Facing Application
source
T1112: Modify Registry
source
T1136.001: Local Account
source
T1134.002: Create Process with Token
source
T1125: Video Capture
source
T1090: Proxy
source
T1685.005: Clear Windows Event Logs
source
T1083: File and Directory Discovery
source
T1057: Process Discovery
source
T1071.002: File Transfer Protocols
source
T1571: Non-Standard Port
source
T1685: Disable or Modify Tools
source
T1012: Query Registry
source
T1499: Endpoint Denial of Service
source
T1059.003: Windows Command Shell
source
T1070.004: File Deletion
source
T1071.001: Web Protocols
source
T1046: Network Service Discovery
source
T1105: Ingress Tool Transfer
source
T1021.001: Remote Desktop Protocol
source
T1686: Disable or Modify System Firewall
source
T1569.002: Service Execution
source
T1055.001: Dynamic-link Library Injection
source
T1056.004: Credential API Hooking
source