Malware: Hi-Zor

Description

[Hi-Zor](https://attack.mitre.org/software/S0087) is a remote access tool (RAT) that has characteristics similar to [Sakula](https://attack.mitre.org/software/S0074). It was used in a campaign named INOCNATION. (Citation: Fidelis Hi-Zor)

External References

• mitre-attack
• Fidelis Hi-Zor

Techniques Used by This Malware

• T1027.013 — Encrypted/Encoded File
• T1059.003 — Windows Command Shell
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1218.010 — Regsvr32
• T1547.001 — Registry Run Keys / Startup Folder
• T1573.001 — Symmetric Cryptography
• T1573.002 — Asymmetric Cryptography