a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364

General

Target
Kivun_Terminal_Setup.exe
Size 1.3MB
Sample260702-cklr6sa12y
SHA256 a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364
MD5 254d3d10a88e3cee5e9e55db236b7747
SHA1 ad8cd46353f8e11233e1c06e15ea304637c8503e
SHA512 0391bfe6c2492a79a020e4991586a948c73d5daa388d201d1a718063e043267d2d075396499e2bf9013cbc65bf01ec6dd3da6aebf8bb2e113add2579d603fae8
SSDEEP 24576:2yWZelQBzaiRb4vMbwJzGyc6DLv/rzWX1vrBtXO5Vlh38vIO6NM/Qs9hc9Ll21Ak:FvQBeiR8vMbwJDcILvXm59tX4Vzaj64/
TLSH
T1E55523A6BA408925DBB30C3057F176E13AB61F628DCD6D07EB1C3264F93669C680B259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Kivun_Terminal_Setup.exe
- Size 1.3MB
- SHA256 a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364
- MD5 254d3d10a88e3cee5e9e55db236b7747
- SHA1 ad8cd46353f8e11233e1c06e15ea304637c8503e
- SHA512 0391bfe6c2492a79a020e4991586a948c73d5daa388d201d1a718063e043267d2d075396499e2bf9013cbc65bf01ec6dd3da6aebf8bb2e113add2579d603fae8
- SSDEEP 24576:2yWZelQBzaiRb4vMbwJzGyc6DLv/rzWX1vrBtXO5Vlh38vIO6NM/Qs9hc9Ll21Ak:FvQBeiR8vMbwJDcILvXm59tX4Vzaj64/
- TLSH
  T1E55523A6BA408925DBB30C3057F176E13AB61F628DCD6D07EB1C3264F93669C680B259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  KivunTerminal.exe
- Size 165KB
- SHA256 bea06c36a8d4397454a8dcfe7a6ccbaedd8537ab9cc8af417416c89117e0c01b
- MD5 0b6f3fdbec32889cb8f51ff14b9c1470
- SHA1 8d21b2b63dd9440e6529508bf430f13f62120c71
- SHA512 dca3c2a4083cf514a8be8f51f611dd1a222f07544d01d672b8566bdafbddbe8d23814f8f6b8098168843f5c2f9224709aa4fd17b0230a73d8a4e26c54febcad2
- SSDEEP 3072:5X5iOhyOweJrhVQ6KB06quUGWc6vUpuI8s5SHsw:ThyO1rXKBtquUGNpS0
- TLSH
  T152F33883B2A521E4E3338D388AE10515A7737D360B685FDB13983255AE33ACC5D3BB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral5
- Target
  kivun-claude-bidi/test/strip-bullet.test.js
- Size 5KB
- SHA256 eb57f61ece7053ec0c609a7b1cfbc103cf3ce90b27c168282fb236746c74a349
- MD5 8de98849d7b78a6f5f419f9129cce474
- SHA1 d7f1a2538df3531a007a15bb54aaeed4cc3583b1
- SHA512 d3d6e6b8b457c86a089c0169ffcc54f61c88075bca083414c306621e454e14702a07aef2497e495efcd459faa96fbb264c4095ddfa4ed9f740c30c7c240ae729
- SSDEEP 96:HM8P0oloKNH/gE1miGpfrFxrAfKSn1h4d59v8A7Fdqw/ylg4Tb9Nz8Q2:HMC0oloKNH/gQ4j7S1GPFqwalg4H9N4P
- TLSH
  T14EC1734D27EE82350AB350F2A70F62D67114C45A5289F694B6DA93082FC33ED48635FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  kivun-claude-bidi/test/strip-incoming.test.js
- Size 8KB
- SHA256 31e3a31c5b6bfa930c416102510bee39b83e59662070d1c63eaced3041356dc7
- MD5 a751e0387b01dc7e47ceacb5646bca60
- SHA1 e64905d5ff54924697daa832374de5e605990b0b
- SHA512 bab41d280c47185efed9583282b2c3ab41df4971216f342f9affbdfbb95c3697e65892e467c9bf269527174e819d27a03fe06ed2c6e2310887442e3ea24854ac
- SSDEEP 192:j9pM9V5K9idpc3JRTyTUPMdwi7+jk5tHN:j9K0icJRuTU+V7D51N
- TLSH
  T12602D74642FA6220303BA2ADB75F50197535C0636254EAD074FED2163FD2BAC83739FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7