Skip to content

Hide Navigation Hide TOC

Zeroaccess - S0027 (552462b9-ae79-49dd-855c-5973014e157f)

Zeroaccess is a kernel-mode Rootkit that attempts to add victims to the ZeroAccess botnet, often for monetary gain. (Citation: Sophos ZeroAccess)

Cluster A Galaxy A Cluster B Galaxy B Level
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5) Attack Pattern Zeroaccess - S0027 (552462b9-ae79-49dd-855c-5973014e157f) Malware 1
Zeroaccess - S0027 (552462b9-ae79-49dd-855c-5973014e157f) Malware Rootkit - T1014 (0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b) Attack Pattern 1
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5) Attack Pattern Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern 2