SOFTWARE
SOFTWARE
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Hikit
Hikit is malware that has been used by Axiom for late-stage persistence and exfiltration after the initial compromise. [1] [2]
ID: S0009
Type: MALWARE
Platforms: Windows
Contributors: Christopher Glyer, FireEye, @cglyer
Version: 1.1
Created: 31 May 2017
Last Modified: 13 May 2020
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Hikit has the ability to create a remote shell and run given commands. [3] |
Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography | |
Enterprise | T1574 | .001 | Hijack Execution Flow: DLL Search Order Hijacking |
Hikit has used DLL Search Order Hijacking to load |
Enterprise | T1090 | .001 | Proxy: Internal Proxy | |
Enterprise | T1014 | Rootkit | ||
Enterprise | T1553 | .004 | Subvert Trust Controls: Install Root Certificate |
Hikit uses |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0001 | Axiom |
References
×