Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)

Kasidet is a backdoor that has been dropped by using malicious VBA macros. (Citation: Zscaler Kasidet)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Disable or Modify System Firewall - T1562.004 (5372c5fe-f424-4def-bcd5-d3a8e770f07b)	Attack Pattern	Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Neutrino (3760920e-4d1a-40d8-9e60-508079499076)	Malpedia	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384)	Attack Pattern	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	1
Kasidet - S0088 (26fed817-e7bf-41f9-829a-9075ffac45c2)	Malware	Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	1
Disable or Modify System Firewall - T1562.004 (5372c5fe-f424-4def-bcd5-d3a8e770f07b)	Attack Pattern	Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529)	Attack Pattern	2
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	2
Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2)	Attack Pattern	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	2
Software Discovery - T1518 (e3b6daca-e963-4a69-aee6-ed4fd653ad58)	Attack Pattern	Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384)	Attack Pattern	2
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	2