1. Home
  2. Software
  3. Ixeshe

Ixeshe

Ixeshe is a malware family that has been used since at least 2009 against targets in East Asia. [1]

ID: S0015
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.2
Created: 31 May 2017
Last Modified: 20 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

Ixeshe can collect data from a local system.[2]
Enterprise T1036 .005 伪装: Match Legitimate Name or Location

Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.[2]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.[2]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Ixeshe is capable of executing commands via cmd.[2]
Enterprise T1071 .001 应用层协议: Web Protocols

Ixeshe uses HTTP for command and control.[1][2]
Enterprise T1132 .001 数据编码: Standard Encoding

Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.[1][2]
Enterprise T1083 文件和目录发现

Ixeshe can list file and directory information.[2]
Enterprise T1070 .004 移除指标: File Deletion

Ixeshe has a command to delete a file from the machine.[2]
Enterprise T1082 系统信息发现

Ixeshe collects the computer name of the victim's system during the initial infection.[2]
Enterprise T1033 系统所有者/用户发现

Ixeshe collects the username from the victim’s machine.[2]
Enterprise T1007 系统服务发现

Ixeshe can list running services.[2]
Enterprise T1016 系统网络配置发现

Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.[2]
Enterprise T1105 输入工具传输

Ixeshe can download and execute additional files.[2]
Enterprise T1057 进程发现

Ixeshe can list running processes.[2]
Enterprise T1564 .001 隐藏伪装: Hidden Files and Directories

Ixeshe sets its own executable file's attributes to hidden.[2]

Groups That Use This Software

ID Name References
G0005 APT12

[1][3]

References

  1. Moran, N., & Villeneuve, N. (2013, August 12). Survival of the Fittest: New York Times Attackers Evolve Quickly [Blog]. Retrieved November 12, 2014.
  2. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  1. Moran, N., Oppenheim, M., Engle, S., & Wartell, R.. (2014, September 3). Darwin’s Favorite APT Group [Blog]. Retrieved November 12, 2014.