Hi-Zor — Malware Profile

Hi-Zor is a remote access tool (RAT) that has characteristics similar to Sakula. It was used in a campaign named INOCNATION.

MITRE ATT&CK techniques (9)

• T1027.013 Encrypted/Encoded File
• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1105 Ingress Tool Transfer
• T1218.010 Regsvr32
• T1547.001 Registry Run Keys / Startup Folder
• T1573.001 Symmetric Cryptography
• T1573.002 Asymmetric Cryptography

Read the full analysis on IntelFusions