Procedure examples

ZxShell can transfer files from a compromised host.

ZxShell can check the services on the system.

ZxShell can query the netsvc group value data located in the svchost group Registry key.

ZxShell has remote desktop functionality.

ZxShell supports functionality for VNC sessions.

ZxShell can collect the owner and organization information from the target workstation.

ZxShell can launch port scans.

ZxShell is injected into a shared SVCHOST process.

ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.

ZxShell hooks several API functions to spawn system threads.

ZxShell has a command, ps, to obtain a listing of processes on the system.

ZxShell can launch a reverse command shell.

ZxShell can delete files from the system.

ZxShell has used HTTP for C2 connections.

ZxShell has used FTP for C2 connections.

ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.

ZxShell has a command to open a file manager and explorer on the system.

ZxShell can set up an HTTP or SOCKS proxy.

ZxShell has a command to transfer files from a remote host.

ZxShell can leverage native API including RegisterServiceCtrlHandler to register a service.RegisterServiceCtrlHandler

ZxShell can create Registry entries to enable services to run.

ZxShell can capture screenshots.

ZxShell has a command to perform video device spying.

ZxShell has a command called RunAs, which creates a new process as another user or process context.

ZxShell has a feature to create local user accounts.

ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.

ZxShell has used rundll32.exe to execute other DLLs and named pipes.

ZxShell has a feature to perform SYN flood attack on a host.

ZxShell can create a new service using the service parser function ProcessScCommand.

ZxShell can create a new service for execution.

ZxShell can use ports 1985 and 1986 in HTTP/S communication.

ZxShell can kill AV products' processes.

ZxShell has a command to clear system event logs.

ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.