Koadic

MITRE ATT&CK: S0250 View on attack.mitre.org

Aliases: Koadic

First seen
2017-07-01 00:00:00
Malware type
rat
Family
Malware family
Operating systems
windows
Related IoCs
34 (30 malicious)
Last IoC activity
2026-10-13 19:43:40
Profile updated
2026-07-07 12:42:41

Targeted industries: government-and-public-sector

Context

Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub. Koadic has several options for staging payloads and creating implants, and performs most of its operations using Windows Script Host.

Recent IoC activity

30 malicious indicators in Maltiverse are attributed to Koadic (S0250). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname usoram2026.duckdns.org 2026-10-13 2
file sample start.bat 2026-09-16 3
file sample Villa_Interior_Design_Construction_Request.bat 2026-09-02 2
file sample Right-click to open Invoice Details.bat 2026-08-27 1
file sample health-records-26153-x-ray-pdl.bat 2026-07-28 2
file sample start.bat 2026-07-11 1
file sample hold.bat 2026-06-23 1
file sample Radiografia Dental Imagen Panoramica V12.bat 2026-06-18 2
file sample Photo XRay Ultrasound Medical Records C1203.bat 2026-06-16 2
file sample VT_startupppp.bat 2026-05-21 1
file sample _VT_new.bat 2026-05-20 1
file sample Banco BPM_Bonifico Bancario.pdf.7z 2026-05-20 1
file sample Startupppppppppp.bat 2026-04-13 2
file sample Startupppppppppp (2).bat 2026-03-08 2
file sample 7a3962542b2a4b3f2b4d157c2efbcfaba87f347419de7b2671b84be71c93234e 2025-12-16 1
file sample BBRXt.bat 2025-10-30 1
file sample SC-56379309223.pdf.lnk 2025-10-24 1
hostname petcasalove.site 2025-10-21 1
file sample videoconferencia.msi 2025-10-21 1
file sample Radiografie Dentara Panoramica 3D RQ1510.bat 2025-10-16 1

Detection coverage

  • 2 YARA rules
  • 798 Sigma rules

Malware & tools used

  • System Network Configuration Discovery (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Visual Basic (attack-pattern)
  • Mshta (attack-pattern)
  • Dynamic-link Library Injection (attack-pattern)
  • Regsvr32 (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Hidden Window (attack-pattern)
  • Security Account Manager (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Web Protocols (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • PowerShell (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Bypass User Account Control (attack-pattern)
  • Network Service Discovery (attack-pattern)
  • Remote Desktop Protocol (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • NTDS (attack-pattern)
  • Service Execution (attack-pattern)
  • Data from Local System (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Network Share Discovery (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Koadic_Auto (yara-rule)
  • DITEKSHEN_MALWARE_JS_Koadicjs (yara-rule)

Reports & references

  • secureworks.com — Cobalt Trinity (report)
  • secureworks.com — Gold Drake (report)
  • cdn-cybersecurity.att.com — Global Perspective Of The Sidewinder Apt (report)
  • researchcenter.paloaltonetworks.com — Unit42 Sofacy Groups Parallel Attacks (report)
  • web.archive.org — Lazyscripter (report)
  • secureworks.com — Gold Drake (report)
  • secureworks.com — Cobalt Ulster (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Koadic (report)
  • github.com — Koadic (report)
  • blog.tofile.dev — Koadic Jarm (report)
  • MITRE ATT&CK — S0250 (report)
  • github.com — Koadic (report)
  • labs.bitdefender.com — 5 Times More Coronavirus Themed Malware Reports During March (report)
  • resources.malwarebytes.com — Lazyscripter (report)
  • secureworks.com — Cobalt Ulster (report)
  • jsac.jpcert.or.jp — Jsac2024 1 9 Takeda Furukawa En (report)
  • prodaft.com — Silverfish Tlpwhite (report)

External references