(Trend Micro) The encryption for the initial packets sent by the BKDR_KIVARS uses RC4 as the encryption. It includes the following information: • Victim’s IP • Possible Campaign ID • OS version • Hostname • Username • KIVARS version • Recent Document\Desktop folder • Keyboard Layout
TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
IP:Port | Timestamp |
---|
Domain | Timestamp |
---|
URL | Timestamp |
---|
2020-09-29 by Threat Hunter Team from Symantec
2017-06-22 by Lenart Bermejo from Trend Micro
2016-03-01 by Razor Huang from Trend Micro
2014-07-02 by Kervin Alintanahin from Trend Micro
Tool: KIVARS
Names: KIVARS
Description: (Trend Micro) The encryption for the initial packets sent by the BKDR_KIVARS uses RC4 as the encryption. It includes the following information: • Victim’s IP • Possible Campaign ID • OS version • Hostname • Username • KIVARS version • Recent Document\Desktop folder • Keyboard Layout
Category: Malware
Type: Reconnaissance
Information: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt
Information: https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html
Mitre-attack: https://attack.mitre.org/software/S0437/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.kivars
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:kivars
Last-card-change: 2022-12-30
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1564.003 HIDE ARTIFACTS : HIDDEN WINDOW kivars has the ability to conceal its activity through hiding active windows. T1070.004 INDICATOR REMOVAL : FILE DELETION kivars has the ability to uninstall malware from the infected host. | T1056.001 INPUT CAPTURE : KEYLOGGING kivars has the ability to initiate keylogging on the infected host. | T1056.001 INPUT CAPTURE : KEYLOGGING kivars has the ability to initiate keylogging on the infected host. |