Hide Navigation Hide TOC

SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)

SodaMaster is a fileless malware used by menuPass to download and execute payloads since at least 2020.(Citation: Securelist APT10 March 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Asymmetric Cryptography - T1573.002 (bf176076-b789-408e-8cba-7275e81c0ada)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Query Registry - T1012 (c32f7008-9fea-41f7-8366-5eb9b74bd896)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Time Based Evasion - T1497.003 (4bed873f-0b7d-41d4-b93a-b6905d1f90b0)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	SodaMaster - S0627 (94d6d788-07bb-4dcc-b62f-e02626b00108)	Malware	1
System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d)	Attack Pattern	2
Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118)	Attack Pattern	Asymmetric Cryptography - T1573.002 (bf176076-b789-408e-8cba-7275e81c0ada)	Attack Pattern	2
Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118)	Attack Pattern	2
Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d)	Attack Pattern	Time Based Evasion - T1497.003 (4bed873f-0b7d-41d4-b93a-b6905d1f90b0)	Attack Pattern	2