S0004 TinyZBot
TinyZBot is a bot written in C# that was developed by Cleaver. 1
| Item | Value |
|---|---|
| ID | S0004 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.1 |
| Created | 31 May 2017 |
| Last Modified | 22 July 2022 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| enterprise | T1547 | Boot or Logon Autostart Execution | - |
| enterprise | T1547.001 | Registry Run Keys / Startup Folder | TinyZBot can create a shortcut in the Windows startup folder for persistence.1 |
| enterprise | T1547.009 | Shortcut Modification | TinyZBot can create a shortcut in the Windows startup folder for persistence.1 |
| enterprise | T1115 | Clipboard Data | TinyZBot contains functionality to collect information from the clipboard.1 |
| enterprise | T1059 | Command and Scripting Interpreter | - |
| enterprise | T1059.003 | Windows Command Shell | TinyZBot supports execution from the command-line.1 |
| enterprise | T1543 | Create or Modify System Process | - |
| enterprise | T1543.003 | Windows Service | TinyZBot can install as a Windows service for persistence.1 |
| enterprise | T1562 | Impair Defenses | - |
| enterprise | T1562.001 | Disable or Modify Tools | TinyZBot can disable Avira anti-virus.1 |
| enterprise | T1056 | Input Capture | - |
| enterprise | T1056.001 | Keylogging | TinyZBot contains keylogger functionality.1 |
| enterprise | T1113 | Screen Capture | TinyZBot contains screen capture functionality.1 |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0003 | Cleaver | 1 |