Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)

Kivars is a modular remote access tool (RAT), derived from the Bifrost RAT, that was used by BlackTech in a 2010 campaign.(Citation: TrendMicro BlackTech June 2017)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)	Malware	1
File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)	Malware	1
Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)	Malware	1
Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)	Malware	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)	Malware	1
Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)	Malware	Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba)	Attack Pattern	1
Hidden Window - T1564.003 (cbb66055-0325-4111-aca0-40547b6ad5b0)	Attack Pattern	Kivars - S0437 (b2d134a1-7bd5-4293-94d4-8fc978cb1cd7)	Malware	1
Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	2
Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2)	Attack Pattern	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	2
Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	Hidden Window - T1564.003 (cbb66055-0325-4111-aca0-40547b6ad5b0)	Attack Pattern	2