Malware: Zox

Description

[Zox](https://attack.mitre.org/software/S0672) is a remote access tool that has been used by [Axiom](https://attack.mitre.org/groups/G0001) since at least 2008.(Citation: Novetta-Axiom)

External References

• mitre-attack
• Novetta-Axiom

Techniques Used by This Malware

• T1001.002 — Steganography
• T1005 — Data from Local System
• T1021.002 — SMB/Windows Admin Shares
• T1027.013 — Encrypted/Encoded File
• T1057 — Process Discovery
• T1068 — Exploitation for Privilege Escalation
• T1082 — System Information Discovery
• T1083 — File and Directory Discovery
• T1105 — Ingress Tool Transfer

APT Groups Using This Malware

• Axiom