Skip to main content
Mallory
MalwareUsed by 1 actor

ZAPiXDESK

ZAPIXDESK is a malware/tool used by the threat cluster UAC-0247 in an espionage campaign targeting Ukraine, including municipal authorities, local self-government bodies, clinical hospitals, emergency medical services, and in some cases representatives of Ukraine’s Defense Forces and FPV drone operators. CERT-UA reported that the malware was used specifically to steal data from the WhatsApp messenger application, including WhatsApp accounts/data on compromised systems. It was observed alongside other malware and tooling such as AGINGFLY, SILENTLOOP, and CHROMELEVATOR in attacks that commonly began with phishing emails themed around humanitarian aid, links to malicious archive files, and in some cases fake organization websites or compromised legitimate websites. In the broader intrusion set, attackers also conducted reconnaissance, lateral movement, and covert tunneling inside victim networks. The provided content does not include technical implementation details or specific indicators of compromise unique to ZAPIXDESK itself.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
UAC-0247

...or from WhatsApp accounts using a tool called ZapixDesk.

via the record mediatherecord.media
MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence1

The attacks typically began with phishing emails posing as discussions about proposals for humanitarian aid. Victims were asked to follow a link that led to the download of a malicious archive file.

T1566.002Spearphishing LinkEvidence1

Victims were asked to follow a link that led to the download of a malicious archive file.

Execution

1 technique
T1059.001PowerShellEvidence2
TacticExecution

BouncyCastle.Cryptography.dll must be in the same directory of the ZAPiXDESK.ps1 file... It may also be necessary to enable set the execution policy to Unrestricted or Bypass in PowerShell to execute the script... run script: .\ZAPiXDESK.ps1

T1548Abuse Elevation Control MechanismEvidence1

Open PowerShell on target computer (it will attempt to claim administrative rights).

Credential Access

3 techniques
T1528Steal Application Access TokenEvidence2

a separate tool called ZAPIXDESK was used specifically to steal data from the WhatsApp messenger application.

T1555Credentials from Password StoresEvidence2

First, it obtains the OfflineDeviceUniqueID... It generates the first decryption key to session.db based on staticKey protect by DPAPI-NG than recovers clientKey from WAL file... With clientKey, it is able to derives encryption key... where all other keys were stored and are recovered from WAL file. DbKeys are used to decrypt the others databases.

T1649Steal or Forge Authentication CertificatesEvidence1

First, it obtains the OfflineDeviceUniqueID, indicating the method used (TPM, REGISTRY, etc...), used in keys derivations linked to the machine.

Collection

2 techniques
T1005Data from Local SystemEvidence1

A script that extracts DBKeys and decrypts all SQLITE3 database files (including db and write-ahead-logfiles ). On completion a ZIP file containing all WhatsApp decrypted LocalState db's... The tool copies the WhatsApp localstate files (where SQLite3 DB files are located) to operate them

T1213Data from Information RepositoriesEvidence1

... або ж з месенджеру WhatsApp (із застосуванням програмного засобу ZAPIXDESK) ...

T1105Ingress Tool TransferEvidence1

Also downloaded to the infected machine is a malware family dubbed AGINGFLY and a PowerShell script referred to as SILENTLOOP

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.md5●●●●●●●●●●●●View more in app2 months ago
hash.md5●●●●●●●●●●●●View more in app2 months ago
hash.sha256●●●●●●●●●●●●View more in app2 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.