aol.pm

Koadic

Software · ATTACK:enterprise:S0250

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0250",
  "title": "Koadic",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0250",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--c8655260-9f4b-44e3-85e1-6538a5f6e4f4",
  "external_id": "S0250",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2024-11-17T14:12:07.296Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Koadic"
    },
    {
      "source_name": "MalwareBytes LazyScripter Feb 2021",
      "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
    },
    {
      "source_name": "Palo Alto Sofacy 06-2018",
      "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
    },
    {
      "source_name": "Github Koadic",
      "url": "https://github.com/offsecginger/koadic"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03be081b-574e-4ffd-807a-99163b6a6fa2

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--055261fd-70cd-49c6-b9e6-2641bae4dda7

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08738197-aa06-4177-acc2-10569c39f423

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1218.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1567d198-b2b9-4eda-a2e2-ba5dd4e51547

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21674a10-7168-420e-b916-2979a3ee3b5e

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1218.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2853aaaa-982e-49bf-a219-b4f16805b983

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3298bf92-55a2-49eb-aa5e-0530e8a51eeb

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3339e98d-9078-496e-bc24-8bcf5f86ac33

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35e6542c-b796-478b-b42d-d5b4ddf511d5

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--419392f5-e6a8-4eee-b7c2-f0bac5cce833

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--540aa8c9-2a16-4c8a-be79-8dbd2d5d0ef4

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ddcecdb-9e54-4e8e-b67b-64d24ec3264a

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--635e93f3-ba76-43c5-961e-8464d4c257c3

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66440b92-cfed-441c-85fd-1d103684a187

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b794c49-0734-446c-9192-5b1e1cf06be0

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72f5ca9f-6b0e-4051-b2ae-da1b59e6ed2b

Github Koadic

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0250

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a3963b8-3ffd-41a9-bd03-57cba4f03882

Palo Alto Sofacy 06-2018

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b0a1eb4-9797-41cd-b7a4-610cb9eb2c42

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8674de47-b051-4384-a6e0-aeed32b8c270

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94472a50-e097-4b67-9f59-2840a1633a0f

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--969e4342-1635-4e0f-8855-47be84cddccf

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a359e758-a95c-4064-b8d7-b8351489409e

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaa2f519-62f6-4dcb-8193-6ed33b8ff4ab

Github Koadic

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:S0250

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7972596-a87d-48fd-bd6f-f140e16f99a6

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc9ffcec-db79-4913-91ae-ffd5cec643f7

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9b7596b-185a-4a2f-8559-6b9349f4c9b9

Github Koadic

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:S0250

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eab4c1aa-d84d-4111-ab87-710345bdd31d

ATT Sidewinder January 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f25505f6-dbd0-4d7b-8e8c-b3885f206cbf

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f32e0356-d326-4dd7-9c5f-4c1c304d8862

Github Koadic

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5c05a9e-955d-459d-a761-228ec3803394

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S0250

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd119308-f4b9-4d06-adf2-08a76baee7d9

Reaqta MuddyWater November 2017 · TrendMicro POWERSTATS V3 June 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.