KoadicMalware
Koadic is an open-source post-exploitation framework for Windows, created by zerosum0x0 and available on GitHub. The framework is written in Python and can generate JScript and VBScript payloads which can be written to disk or mapped directly into memory.From MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs3 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System (T1005)”
- T1087Account Discovery
“Account Discovery (T1087), Remote System Discovery (T1096)”
- T1110Brute Force
“This can be indicative of a brute force or password spraying attack.”
- T1110.003Password Spraying
“This can be indicative of a brute force or password spraying attack.”
- T1195Supply Chain Compromise
“… challenging and time-consuming to identify persistence mechanisms left by an advanced adversary as we saw in the 2020 SUNBURST supply chain compromise.”
- T1559.001Component Object Model
“…ections due its interesting way of leveraging technologies built into the Windows OS — such as Windows Script Host (WSH) and the Component Object Model (COM).”
What the reports say
3 reports, newest first · the exact sentence from each-
Identifying beaconing malware using Elastic“Below is an example of a Koadic C2 beacon, which serves the malicious payload using the DLL host process.”
-
Security operations: Cloud monitoring and detection with Elastic Security“Pacu is modular, similar to other exploitation frameworks like Metasploit and Koadic, and enables attackers to exploit configuration flaws within an AWS account.”
-
Embracing offensive tooling: Building detections against Koadic using EQL“Embracing offensive tooling: Building detections against Koadic using EQL”
Indicators in its reports
named in the reports above- 192.99.221[.]77in 1 report
- 83.171.237[.]173in 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.