Malware.View on attack.mitre.org
Kasidet is a backdoor that has been dropped by using malicious VBA macros.
| Technique | Procedure example |
|---|---|
| T1056.001 Keylogging |
Kasidet has the ability to initiate keylogging. |
| T1057 Process Discovery |
Kasidet has the ability to search for a given process name in processes currently running in the system. |
| T1059.003 Windows Command Shell |
Kasidet can execute commands using cmd.exe. |
| T1082 System Information Discovery |
Kasidet has the ability to obtain a victim's system name and operating system version. |
| T1083 File and Directory Discovery |
Kasidet has the ability to search for a given filename on a victim. |
| T1105 Ingress Tool Transfer |
Kasidet has the ability to download and execute additional files. |
| T1113 Screen Capture |
Kasidet has the ability to initiate keylogging and screen captures. |
| T1518.001 Security Software Discovery |
Kasidet has the ability to identify any anti-virus installed on the infected system. |
| T1547.001 Registry Run Keys / Startup Folder |
Kasidet creates a Registry Run key to establish persistence. |
| T1686 Disable or Modify System Firewall |
Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
