Poison Ivy is a popular remote access tool (RAT) that has been used by many groups.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|---|
| 5.153.123.11:3460 | 2023-11-25 |
| 94.98.183.32:3460 | 2023-11-23 |
| 94.98.229.240:3460 | 2023-11-19 |
| 94.49.183.29:3460 | 2023-11-10 |
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2022-11-30 by Matsumoto from FFRI Security
2022-08-22 by Shunichi Imano from Fortinet
2022-07-31 by BushidoToken from BushidoToken Blog
2022-07-18 by Unit 42 from Palo Alto Networks Unit 42
2022-07-18 by Unit 42 from Palo Alto Networks Unit 42
2022-05-17 by Positive Technologies from Positive Technologies
2022-05-16 by Shusei Tomonaga from JPCERT/CC
2021-06-16 by Insikt Group® from Recorded Future
2021-03-17 by Insikt Group® from Recorded Future
2021-02-01 by Ignacio Sanmillan from ESET Research
2021-01-15 by Markus Neis from Swisscom
2021-01-08 by Fumio Ozawa from Youtube (Virus Bulletin)
2020-10-01 by US-CERT from US-CERT
2020-09-30 by Fumio Ozawa from NTT Security
2020-09-30 by Fumio Ozawa from NTT Security
2020-09-16 by Jon Gross from RiskIQ
2020-08-28 by Fumio Ozawa from NTT
2020-08-19 by Fumio Ozawa from NTT Security
2020-03-12 by Check Point Research from Check Point
2020-03-02 by Alex Hinchliffe from Virus Bulletin
2020-01-29 by nao_sec from nao_sec blog
2020-01-09 by Jagaimo Kawaii from Lab52
2020 by SecureWorks from Secureworks
2020 by SecureWorks from Secureworks
2020 by SecureWorks from Secureworks
2020 by SecureWorks from Secureworks
2020 by SecureWorks from Secureworks
2019-12-12 by Microsoft Threat Intelligence Center from Microsoft
2019-11-19 by Kelli Vanderlee from FireEye
2019-07-23 by Michael Raggi from Proofpoint
2019-06-25 by Cybereason Nocturnus from Cybereason
2019 by Lion Gu from Virus Bulletin
2018-09-21 by Qihoo 360 from Qihoo 360 Technology
2018-05-15 by Keven Murphy from BSides Detroit
2017-09-15 by Xiaopeng Zhang from Fortinet
2017-08-31 by Ahmed Zaki from NCC Group
2017-08-23 by Xiaopeng Zhang from Fortinet
2017-05-31 by MITRE ATT&CK from MITRE
2016-11-22 by Vicky Ray from Palo Alto Networks Unit 42
2016-04-26 by Jason Jones from Github (CyberMonitor)
2016-04-22 by Micah Yates from Palo Alto Networks Unit 42
2015-02-06 by CrowdStrike from CrowdStrike
2014-09-19 by Jen Miller-Osborn from Palo Alto Networks Unit 42
2014 by FireEye from FireEye
2013-10-31 by Thoufique Haq from FireEye
2013-08-23 by Nart Villeneuve from FireEye
2011 by Erica Eng from Symantec
2010-07-30 by Mila Parkour from Contagiodump Blog
2010-01-17 by Mila Parkour from Contagiodump Blog
2010 by _ from F-Secure
2010 by Ero Carrera from Mandiant
Tool: Poison Ivy
Names: Poison Ivy, pivy, poisonivy, Gen:Trojan.Heur.PT, Darkmoon, Chymine, SPIVY
Description: Poison Ivy is a popular remote access tool (RAT) that has been used by many groups.
Category: Malware
Type: Reconnaissance, Backdoor, Info stealer, Credential stealer, Exfiltration
Information: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf
Information: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant.html
Information: https://blog.fortinet.com/2017/09/15/deep-analysis-of-new-poison-ivy-plugx-variant-part-ii
Information: http://contagiodump.blogspot.com/2010/01/jan-17-trojan-darkmoonb-exe-haiti.html
Information: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/analysing-a-recent-poison-ivy-sample/
Information: https://www.fireeye.com/blog/threat-research/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html
Information: http://blogs.360.cn/post/APT_C_01_en.html
Mitre-attack: https://attack.mitre.org/software/S0012/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_ivy
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmoon
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:Poison%20Ivy
Last-card-change: 2022-12-29
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1059.003 COMMAND AND SCRIPTING INTERPRETER : WINDOWS COMMAND SHELL poisonivy creates a backdoor through which remote attackers can open a command-line interface. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER poisonivy creates run key registry entries pointing to a malicious executable dropped to disk. T1547.014 BOOT OR LOGON AUTOSTART EXECUTION : ACTIVE SETUP poisonivy creates a registry key in the active setup pointing to a malicious executable. T1543.003 CREATE OR MODIFY SYSTEM PROCESS : WINDOWS SERVICE poisonivy creates a registry subkey that registers a new service. poisonivy also creates a registry entry modifying the logical disk manager service to point to a malicious dll dropped to disk. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER poisonivy creates run key registry entries pointing to a malicious executable dropped to disk. T1547.014 BOOT OR LOGON AUTOSTART EXECUTION : ACTIVE SETUP poisonivy creates a registry key in the active setup pointing to a malicious executable. T1543.003 CREATE OR MODIFY SYSTEM PROCESS : WINDOWS SERVICE poisonivy creates a registry subkey that registers a new service. poisonivy also creates a registry entry modifying the logical disk manager service to point to a malicious dll dropped to disk. T1055.001 PROCESS INJECTION : DYNAMIC-LINK LIBRARY INJECTION poisonivy can inject a malicious dll into a process. | T1027 OBFUSCATED FILES OR INFORMATION poisonivy hides any strings related to its own indicators of compromise. T1055.001 PROCESS INJECTION : DYNAMIC-LINK LIBRARY INJECTION poisonivy can inject a malicious dll into a process. | T1005 DATA FROM LOCAL SYSTEM poisonivy creates a backdoor through which remote attackers can steal system information. | T1573.001 ENCRYPTED CHANNEL : SYMMETRIC CRYPTOGRAPHY poisonivy uses the camellia cipher to encrypt communications. T1105 INGRESS TOOL TRANSFER poisonivy creates a backdoor through which remote attackers can upload files. |