KIVARS

KIVARS
(Type: Reconnaissance)

(Trend Micro) The encryption for the initial packets sent by the BKDR_KIVARS uses RC4 as the encryption. It includes the following information: • Victim’s IP • Possible Campaign ID • OS version • Hostname • Username • KIVARS version • Recent Document\Desktop folder • Keyboard Layout

[News Analysis] Trends:

Total Trend: 4

Trend Per Year
1
2014
1
2016
1
2017
1
2020


Trend Per Month
1
Jul 2014
1
Mar 2016
1
Jun 2017
1
Sep 2020



[News Analysis] News Mention Another Threat Name:

6 - KIVARS6 - PLEAD2 - BlackTech2 - bifrose4 - FakeWord4 - Poison RAT4 - Zeus


[TTP Analysis] Technique Performance:

reconnaissance
0/43
resource development
0/45
initial access
0/19
execution
0/36
persistence
0/113
privilege escalation
0/96
defense evasion
2/184
credential access
1/63
discovery
1/44
lateral movement
1/22
collection
2/37
command and control
1/39
exfiltration
0/18
impact
0/26


[TTP Analysis] Mitre Attack Matrix:

TA0043 TA0042 TA0001 TA0002 TA0003 TA0004 TA0005 TA0006 TA0007 TA0008 TA0009 TA0011 TA0010 TA0040
Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
T1564.003
Hide Artifacts : Hidden Window
T1070.004
Indicator Removal : File Deletion
T1056.001
Input Capture : Keylogging
T1083
File And Directory Discovery
T1021
Remote Services
T1056.001
Input Capture : Keylogging
T1113
Screen Capture
T1105
Ingress Tool Transfer


[Infrastructure Analysis] Based on Related IOC:

IP:Port Timestamp
Domain Timestamp
URL Timestamp


[Target Analysis] Region/Sector:

No information


References:

News Article (Credit @Malpedia)

Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors

2020-09-29 by Threat Hunter Team from Symantec

The Trail of BlackTech’s Cyber Espionage Campaigns

2017-06-22 by Lenart Bermejo from Trend Micro

Shrouded Crossbow Creators Behind BIFROSE for UNIX

2016-03-01 by Razor Huang from Trend Micro

KIVARS With Venom: Targeted Attacks Upgrade with 64-bit “Support”

2014-07-02 by Kervin Alintanahin from Trend Micro

Basic Information (Credit @etda.or.th)

Tool: KIVARS

Names: KIVARS

Description: (Trend Micro) The encryption for the initial packets sent by the BKDR_KIVARS uses RC4 as the encryption. It includes the following information: • Victim’s IP • Possible Campaign ID • OS version • Hostname • Username • KIVARS version • Recent Document\Desktop folder • Keyboard Layout

Category: Malware

Type: Reconnaissance

Information: https://blog.trendmicro.com/trendlabs-security-intelligence/kivars-with-venom-targeted-attacks-upgrade-with-64-bit-support/

Information: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt

Information: https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html

Mitre-attack: https://attack.mitre.org/software/S0437/

Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.kivars

Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:kivars

Last-card-change: 2022-12-30

Source: https://apt.etda.or.th/cgi-bin/listtools.cgi

TTP Info (Credit @Mitre)

TA0043 TA0042 TA0001 TA0002 TA0003 TA0004 TA0005 TA0006 TA0007 TA0008 TA0009 TA0011 TA0010 TA0040
Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
T1564.003
HIDE ARTIFACTS : HIDDEN WINDOW
kivars has the ability to conceal its activity through hiding active windows.
T1070.004
INDICATOR REMOVAL : FILE DELETION
kivars has the ability to uninstall malware from the infected host.
T1056.001
INPUT CAPTURE : KEYLOGGING
kivars has the ability to initiate keylogging on the infected host.
T1083
FILE AND DIRECTORY DISCOVERY
kivars has the ability to list drives on the infected host.
T1021
REMOTE SERVICES
kivars has the ability to remotely trigger keyboard input and mouse clicks.
T1056.001
INPUT CAPTURE : KEYLOGGING
kivars has the ability to initiate keylogging on the infected host.
T1113
SCREEN CAPTURE
kivars has the ability to capture screenshots on the infected host.
T1105
INGRESS TOOL TRANSFER
kivars has the ability to download and execute files.