VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)

VERMIN is a remote access tool written in the Microsoft .NET framework. It is mostly composed of original code, but also has some open source code. (Citation: Unit 42 VERMIN Jan 2018)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Clipboard Data - T1115 (30973a08-aed9-4edf-8604-9084ce1b5c4f)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Automated Collection - T1119 (30208d3e-0d6b-43c8-883e-44462a514619)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	1
Archive Collected Data - T1560 (53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Audio Capture - T1123 (1035cdf2-3e5f-446f-a7a7-e8f6d7925967)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384)	Attack Pattern	1
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	VERMIN - S0257 (5189f018-fea2-45d7-b0ed-23f9ee0a46f3)	Malware	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144)	Attack Pattern	2
Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	2
Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2)	Attack Pattern	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	2
Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	2
Software Discovery - T1518 (e3b6daca-e963-4a69-aee6-ed4fd653ad58)	Attack Pattern	Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384)	Attack Pattern	2
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	2