General
- Target Kivun_Terminal_Setup.exe
- Size 1.3MB
- Sample260704-v2y3yaev7k
- SHA256 a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364
Malware Config
Targets
-
- Target Kivun_Terminal_Setup.exe
- Size 1.3MB
- SHA256 a0eb2651cc3b98796df803c9cf8f57aa64e90629fd168961ad07c45ba2916364
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target KivunTerminal.exe
- Size 165KB
- SHA256 bea06c36a8d4397454a8dcfe7a6ccbaedd8537ab9cc8af417416c89117e0c01b
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target configure-statusline.js
- Size 2KB
- SHA256 3ef3d6749fc0b76a28b3c7eff6bbb0655b1a59a45498b69a9bd9134f83790255
Score3/10 -
- Target folder-picker.hta
- Size 64KB
- SHA256 0ca24f82ab83c89a8b693ba996f051a697548eebf1d8b2b9ea0eea6490d300dc
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target folder-picker.wsf
- Size 3KB
- SHA256 5d984d8eb597e006ad7bb12f29e8c7d16cb7aca64f5768460576b798650447a8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target kivun-claude-bidi/bin/kivun-claude-bidi
- Size 1KB
- SHA256 cee184d0aea62a77f66eb2b8da7e45a874e23cb8776a4edf6438f6e1e637e762
Score1/10 -
- Target kivun-claude-bidi/lib/capability-check.js
- Size 702B
- SHA256 a213a511f7e4b282578e75ac4a11f26e00c06063b16b9f42202cd9f27b3e3e72
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target kivun-claude-bidi/lib/detect-terminal.js
- Size 2KB
- SHA256 4c3e5c66858346f8702569e00067d2505064499b0713bae4fad503b48ff696b8
Score3/10 -
- Target kivun-claude-bidi/lib/injector.js
- Size 23KB
- SHA256 51161461ed703f403a8b19178011ec44a7354d26375258d9ecaeaf74be278e14
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target kivun-claude-bidi/lib/resolve-claude-bin.js
- Size 5KB
- SHA256 60ae680d6a9eec37c8ce6dd79a163e878f7c0289782717ef9c3b6fc68bdd3325
Score3/10 -
- Target kivun-claude-bidi/lib/rtl-cost-optimizer/detector.js
- Size 1KB
- SHA256 87fd848e20f39b8217f801e75447b112f138748eac445f1cca6fa65a35566380
Score3/10 -
- Target kivun-claude-bidi/lib/rtl-cost-optimizer/estimator.js
- Size 1KB
- SHA256 1c684e9bc428c6451390a8801bda8ee2cd8f385b92fc5f56d5f4e5950cc38153
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1