Hi-Zor

S0087

About this malware

Hi-Zor is a remote access tool (RAT) that has characteristics similar to Sakula. It was used in a campaign named INOCNATION.

Technique	Procedure example
T1027.013 Encrypted/Encoded File	Hi-Zor uses various XOR techniques to obfuscate its components. Fidelis INOCNATION
T1059.003 Windows Command Shell	Hi-Zor has the ability to create a reverse shell. Fidelis INOCNATION
T1070.004 File Deletion	Hi-Zor deletes its RAT installer file as it executes its DLL payload file. Fidelis INOCNATION
T1071.001 Web Protocols	Hi-Zor communicates with its C2 server over HTTPS. Fidelis INOCNATION
T1105 Ingress Tool Transfer	Hi-Zor has the ability to upload and download files from its C2 server. Fidelis INOCNATION
T1218.010 Regsvr32	Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism. Fidelis INOCNATION
T1547.001 Registry Run Keys / Startup Folder	Hi-Zor creates a Registry Run key to establish persistence. Fidelis INOCNATION
T1573.001 Symmetric Cryptography	Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys. Fidelis Hi-Zor
T1573.002 Asymmetric Cryptography	Hi-Zor encrypts C2 traffic with TLS. Fidelis Hi-Zor

None recorded.

None recorded.

Fidelis Hi-Zor Open source
Fidelis Threat Research Team. (2016, January 27). Introducing Hi-Zor RAT. Retrieved March 24, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.