Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)

Cadelspy is a backdoor that has been used by APT39.(Citation: Symantec Chafer Dec 2015)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Clipboard Data - T1115 (30973a08-aed9-4edf-8604-9084ce1b5c4f)	Attack Pattern	Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	1
Application Window Discovery - T1010 (4ae4f953-fe58-4cc8-a327-33257e30a830)	Attack Pattern	Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	1
Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	Archive Collected Data - T1560 (53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a)	Attack Pattern	1
Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	1
Audio Capture - T1123 (1035cdf2-3e5f-446f-a7a7-e8f6d7925967)	Attack Pattern	Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	1
Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	1
Cadelspy - S0454 (a705b085-1eae-455e-8f4d-842483d814eb)	Malware	Peripheral Device Discovery - T1120 (348f1eef-964b-4eb6-bb53-69b3dcb0c643)	Attack Pattern	1
Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2)	Attack Pattern	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	2