^[2]

ZxShell has a command called RunAs, which creates a new process as another user or process context.^[2]

ZxShell has used HTTP for C2 connections.^[2]

ZxShell has used FTP for C2 connections.^[2]

ZxShell can launch a reverse command shell.^[1][2][3]

ZxShell has a feature to create local user accounts.^[2]

ZxShell can create a new service using the service parser function ProcessScCommand.^[2]

ZxShell can transfer files from a compromised host.^[2]

ZxShell has a feature to perform SYN flood attack on a host.^[1][2]

ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.^[2]

ZxShell has a command to open a file manager and explorer on the system.^[2]

ZxShell can kill AV products' processes.^[2]

ZxShell can disable the firewall by modifying the registry keyHKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.^[2]

ZxShell has a command to clear system event logs.^[2]

ZxShell can delete files from the system.^[1][2]

ZxShell has a command to transfer files from a remote host.^[2]

ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.^[1][2]

ZxShell hooks several API functions to spawn system threads.^[2]

ZxShell can create Registry entries to enable services to run.^[2]

ZxShell can leverage native API includingRegisterServiceCtrlHandler to register a service.RegisterServiceCtrlHandler

ZxShell can launch port scans.^[1][2]

ZxShell can use ports 1985 and 1986 in HTTP/S communication.^[2]

ZxShell has a command, ps, to obtain a listing of processes on the system.^[2]

ZxShell is injected into a shared SVCHOST process.^[2]

ZxShell can set up an HTTP or SOCKS proxy.^[1][2]

ZxShell can query the netsvc group value data located in the svchost group Registry key.^[2]

ZxShell has remote desktop functionality.^[2]

ZxShell supports functionality for VNC sessions.^[2]

ZxShell can capture screenshots.^[1]

ZxShell has used rundll32.exe to execute other DLLs and named pipes.^[2]

ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.^[2]

ZxShell can collect the owner and organization information from the target workstation.^[2]

ZxShell can check the services on the system.^[2]

ZxShell can create a new service for execution.^[2]

ZxShell has a command to perform video device spying.^[2]

^[2][4]

^[1]

^[3]