Rewterz Threat Alert – ZxShell RAT – Active IOCs

Severity

Medium

Analysis Summary

ZxShell – aka Sensocode – is a remote access trojan backdoor that is available on the internet, especially on Chinese hacker websites. Once downloded, the backdoor can scan ports, work as a keylogger, execute a reverse command shell, generate SYN floods, and more techniques for the data exfiltration. It maintains persistence and can also infect other systems in the network. It was used by threat actor group 72 for cyber espionage operations. ZxShell has been used since at least 2004. Its detection and removal are quite difficult in a system as it has a variety of techniques that makes it undetectable. ZxShell RAT can be used to steal credentials and other sensitive data in the infected system.

Impact

• Unauthorized Access
• Information Theft

Indicators of Compromise

MD5

• 058d59b7186d82f0f5974b95a2a0d29e

SHA-256

• e9a85be6baa40ee6cde16883d7911f0d049399a77092d4a40ac7f241fb701644

SHA-1

• 340fc225cc0859e25e76c0287557f50ceb1f36e3

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Enforced Access Management Policies.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.