ATT&CK ReferencesZScaler Hacking Team

ZScaler Hacking Team

Desai, D.. (2015, August 14). Chinese cyber espionage APT group leveraging recently leaked Hacking Team exploits to target a Financial Services Firm. Retrieved January 26, 2016.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples5

Technique	Used by	Procedure example
T1036.005 Match Legitimate Resource Name or Location	MalwareHTTPBrowser	HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL. ZScaler Hacking Team
T1070.004 File Deletion	MalwareHTTPBrowser	HTTPBrowser deletes its original installer file once installation is complete. ZScaler Hacking Team
T1083 File and Directory Discovery	MalwareHTTPBrowser	HTTPBrowser is capable of listing files, folders, and drives on a victim. Dell TG-3390 ZScaler Hacking Team
T1547.001 Registry Run Keys / Startup Folder	MalwareHTTPBrowser	HTTPBrowser has established persistence by setting the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` key value for `wdm` to the path of the executable. It has also used the Registry entry `HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe”` to establish persistence. ThreatStream Evasion Analysis ZScaler Hacking Team
T1574.001 DLL	MalwareHTTPBrowser	HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll. HTTPBrowser has also used DLL side-loading. Dell TG-3390 ZScaler Hacking Team

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.