Zebrocy
Description
Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, and VB.NET.
Names
| Name |
|---|
| Zebrocy |
| Zekapab |
Category
Malware
Type
- Backdoor
- Info stealer
- Exfiltration
- Tunneling
Information
- https://unit42.paloaltonetworks.com/sofacy-creates-new-go-variant-of-zebrocy-tool/
- https://www.accenture.com/us-en/blogs/blogs-snakemackerel-delivers-zekapab-malware
- https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
- https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
- https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/
- https://securelist.com/greyenergys-overlap-with-zebrocy/89506/
- https://www.vkremez.com/2018/12/lets-learn-dissecting-apt28sofacy.html
- https://www.vkremez.com/2018/12/lets-learn-reviewing-sofacys-zebrocy-c.html
- https://securelist.com/a-zebrocy-go-downloader/89419/
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b
- https://labs.sentinelone.com/a-deep-dive-into-zebrocys-dropper-docs/
Mitre Attack
Malpedia
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy_au3
Other Information
Uuid
1be50485-7c9f-45dc-96b5-1cd8d2977a0e
Last Card Change
2021-04-21