a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364

Sharing

Copy URL Twitter E-mail

General

Target
Kivun_Terminal_Setup.exe
Size 1.3MB
Sample260702-cmcmaaa141
SHA256 a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364
MD5 254d3d10a88e3cee5e9e55db236b7747
SHA1 ad8cd46353f8e11233e1c06e15ea304637c8503e
SHA512 0391bfe6c2492a79a020e4991586a948c73d5daa388d201d1a718063e043267d2d075396499e2bf9013cbc65bf01ec6dd3da6aebf8bb2e113add2579d603fae8
SSDEEP 24576:2yWZelQBzaiRb4vMbwJzGyc6DLv/rzWX1vrBtXO5Vlh38vIO6NM/Qs9hc9Ll21Ak:FvQBeiR8vMbwJDcILvXm59tX4Vzaj64/
TLSH
T1E55523A6BA408925DBB30C3057F176E13AB61F628DCD6D07EB1C3264F93669C680B259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Kivun_Terminal_Setup.exe
- Size 1.3MB
- SHA256 a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364
- MD5 254d3d10a88e3cee5e9e55db236b7747
- SHA1 ad8cd46353f8e11233e1c06e15ea304637c8503e
- SHA512 0391bfe6c2492a79a020e4991586a948c73d5daa388d201d1a718063e043267d2d075396499e2bf9013cbc65bf01ec6dd3da6aebf8bb2e113add2579d603fae8
- SSDEEP 24576:2yWZelQBzaiRb4vMbwJzGyc6DLv/rzWX1vrBtXO5Vlh38vIO6NM/Qs9hc9Ll21Ak:FvQBeiR8vMbwJDcILvXm59tX4Vzaj64/
- TLSH
  T1E55523A6BA408925DBB30C3057F176E13AB61F628DCD6D07EB1C3264F93669C680B259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  KivunTerminal.exe
- Size 165KB
- SHA256 bea06c36a8d4397454a8dcfe7a6ccbaedd8537ab9cc8af417416c89117e0c01b
- MD5 0b6f3fdbec32889cb8f51ff14b9c1470
- SHA1 8d21b2b63dd9440e6529508bf430f13f62120c71
- SHA512 dca3c2a4083cf514a8be8f51f611dd1a222f07544d01d672b8566bdafbddbe8d23814f8f6b8098168843f5c2f9224709aa4fd17b0230a73d8a4e26c54febcad2
- SSDEEP 3072:5X5iOhyOweJrhVQ6KB06quUGWc6vUpuI8s5SHsw:ThyO1rXKBtquUGNpS0
- TLSH
  T152F33883B2A521E4E3338D388AE10515A7737D360B685FDB13983255AE33ACC5D3BB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  configure-statusline.js
- Size 2KB
- SHA256 3ef3d6749fc0b76a28b3c7eff6bbb0655b1a59a45498b69a9bd9134f83790255
- MD5 2901724e2f2323c266967a81f4afc212
- SHA1 451921542778f28daf5d4df9da0658e4b570c204
- SHA512 daad4fa342c5482fd52ddf00f51ed6d2b7f271be207a7fea8a564db1d4b842141c70d97c9cd3fabf120a741f6eea91d642ee16e9baf778fcadea0e3b3d8c3501
- TLSH
  T15E418902C198473A4DA41660E75D01A75B2EC7F623547AB0C27A904719C5DEAC077BDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  folder-picker.hta
- Size 64KB
- SHA256 0ca24f82ab83c89a8b693ba996f051a697548eebf1d8b2b9ea0eea6490d300dc
- MD5 b7feab5508fdadaa1b6306437c83f914
- SHA1 c1ee52a4cb499a11814895acf8353192ce587c20
- SHA512 5106f20471d9c741d1e6c3b5a9f67d59b85bb1388b1f98f616edb9152a37fe50756d5ea91557b4a23c1a316d8ce185e6974ed67d4f11ce9cea780be4722f89a1
- SSDEEP 1536:W0m/73eOFt5RC+NI8yuhjKyE0rwJU/TKHRbxvTNxi5WBM5taZ53OY:wtxKb0rszTNxi5WhaY
- TLSH
  T1D353E727A94805727973B6B9AB9F6216FB7682135301C21078DCE1491FB582481FEFFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  folder-picker.wsf
- Size 3KB
- SHA256 5d984d8eb597e006ad7bb12f29e8c7d16cb7aca64f5768460576b798650447a8
- MD5 cc330394c3e5d6809712e7e9d9e81a93
- SHA1 79249572956b5577d2eb903a5f3ac870a4ee8984
- SHA512 1fe6f4abd0b4b24b7b9d03f49661cf31e1202f0a1f9968ef38cfd6cbbf9bc483e6f5ed176ab557341ae1ed75b9d0248a4f4e43486452071545a8af3405427493
- TLSH
  T1BB61E9422A08D33245369643034DE795FAE7C6373B1AF735348CCA842714AA95EE0BED
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware defense_evasion persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  kivun-claude-bidi/bin/kivun-claude-bidi
- Size 1KB
- SHA256 cee184d0aea62a77f66eb2b8da7e45a874e23cb8776a4edf6438f6e1e637e762
- MD5 6bdd790f1323692f93786600234e8960
- SHA1 171fa42567dc94639f68a1f306aa5b0d00357baa
- SHA512 9fa349cb5ab790b6ae5d6c898de8b9c14ede5c789f93c822dc57b0d5b9bf114eabc0e98e3eb464f00f8946990bbdd8d85d3539800894001ffe2c1486753b3367
- TLSH
  T1353145419D0833361BB052BE670F9236EA7A90366321475174F9C3892B651EC4673AAF
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  kivun-claude-bidi/lib/capability-check.js
- Size 702B
- SHA256 a213a511f7e4b282578e75ac4a11f26e00c06063b16b9f42202cd9f27b3e3e72
- MD5 696fdd5ef1759f6ea33d1050d767983f
- SHA1 24c950e49bec83a0219c4d4c8857e6e6f9c19657
- SHA512 d18a5b8d23fe17d48f231289c6e18356409864c7e3e7725501fc26c24be6c8afca4160e5ad1bea13b75775c71d89ed54d20c66d9c854c175208ef8d1ccad16e9
- TLSH
  T19D01C044E887213017A424E1968B505B29FE5426276C5D76C677D2893F022268377ACB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  kivun-claude-bidi/lib/detect-terminal.js
- Size 2KB
- SHA256 4c3e5c66858346f8702569e00067d2505064499b0713bae4fad503b48ff696b8
- MD5 80d21056fb4032daaf02a3866fdfdab0
- SHA1 dbdc724b7c87c2b64c5e5b2a3125ddba9d07b081
- SHA512 5ea3f4f950b06cead6852418a33a6affb4dee100118369c10c5b6b019d73c9f87cb4e55f4dd8fb2e10e7d5ebe105cf57b314cc8be5339bd1d410f466a61c3246
- TLSH
  T16741C6E26EFA3331014212F5355E612BEA92A03153546610F4CC420D77BABBC6AB67C7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  kivun-claude-bidi/lib/injector.js
- Size 23KB
- SHA256 51161461ed703f403a8b19178011ec44a7354d26375258d9ecaeaf74be278e14
- MD5 44a086ebe778dbe35d6d9a78962850c1
- SHA1 7e0622d92e8d4b70196ddbdd10487a64bf44c858
- SHA512 8bfb58f11e342b61428710f38b54fe92c688946ce557fa6ce73cf4cde99810868481beda46d0ba62198cf2e58302e2afcd958f129b7adf857a8223f1098ed5ad
- SSDEEP 384:+6lk832AskmbhFg7AtDzU9UZgiVkQ8OZLZxITJV53llFTZvBjciLyIuxX7P:+6Cu8f9ZG39VVMb
- TLSH
  T185B2D7AA27DB1235461330AC5FDFA1A2A224CC1B3107D568F86D93CC6F4A9748271EF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  kivun-claude-bidi/lib/resolve-claude-bin.js
- Size 5KB
- SHA256 60ae680d6a9eec37c8ce6dd79a163e878f7c0289782717ef9c3b6fc68bdd3325
- MD5 8085dee9c9318b8d08e506958df2ba34
- SHA1 55821723838c416011c0e9d9cc134b6fc985f4e4
- SHA512 70a125aade3d18041781f21adf5c5bc2e2784c3e9ed681e0154a071831d9ecf61886575fe17c7f9fca8e2b6014fb86a0dc7db8d6ac9d70ecd1ed65937455d38b
- SSDEEP 96:TwqlxZwIvfl3/rcisiYnxYAzRcqLs6AOssHpcokVoWVAwDNS2Crv9ljxp70:Twqj/o/Komqw6jsCcomXewDNSRrvr0
- TLSH
  T16DB1B65B369B633A009066F45F9F20A6B313E042632998D4B66C83441F8A77D02F99EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  kivun-claude-bidi/lib/rtl-cost-optimizer/detector.js
- Size 1KB
- SHA256 87fd848e20f39b8217f801e75447b112f138748eac445f1cca6fa65a35566380
- MD5 180f3db8477e1832f82e06b19f477e98
- SHA1 b538a2dd69196937948af750e4858309c29a2873
- SHA512 4a9a1ff28fde2d4c2e6c762df6849758a15fa545cffbfbf85995af3e5c5087d77be73d13a959031fa68b0c9d2f18d39d81ed1648e7bbc240050aed1202288dd1
- TLSH
  T17631CF0575A36248065A36682597DE03F21C8092A44AFDD07FEE97C02F8A47ED37525D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  kivun-claude-bidi/lib/rtl-cost-optimizer/estimator.js
- Size 1KB
- SHA256 1c684e9bc428c6451390a8801bda8ee2cd8f385b92fc5f56d5f4e5950cc38153
- MD5 16a456c802203dc523350ef86e1879e8
- SHA1 7a16add146e5d44d5ccf55967e393add355fba4a
- SHA512 0d5c985c2b2eaa26a84d0a74b3c86f31ec8b3128385e572ef54df5150641eae820b5c83dfa18bad557135b47d90af02ffe9715e0406c07d1bf7e82376b61ea48
- TLSH
  T16A31DF4D269524944C5621B0AFCBA52893BCC433201EC8B6F9E988CD1FD011AC2F398F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

Checks installed software on the system

Badlisted process makes network request

Checks computer location settings

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32