⚠️ Overview

Kivars is a .NET-based remote access trojan (RAT) first documented by Palo Alto Networks Unit 42 in September 2020. It is attributed to the Iranian state-sponsored threat group APT34 (also known as OilRig) and is used primarily for espionage against government, energy, and telecommunications sectors in the Middle East. The malware operates as a modular backdoor that enables persistent remote access and data exfiltration, falling under the MITRE ATT&CK category of Remote Access Trojans (T1204.002).

🔧 Technical Capabilities

Kivars uses HTTP for command-and-control (C2) communications, encrypting its payload with a custom XOR algorithm and base64 encoding to evade network monitoring. Propagation occurs via spear-phishing emails containing malicious Microsoft Office documents that drop the payload; initial access is often achieved through exploits leveraging CVE-2017-11882 (Equation Editor vulnerability) and CVE-2018-0802. Once installed, it achieves persistence through a scheduled task or registry run key (HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include process hollowing (MITRE T1055.012) and delay injection to bypass sandbox analysis. The malware also collects system information, logs keystrokes, and can upload/download arbitrary files. Its C2 infrastructure uses hardcoded IP addresses and domain generation algorithms (DGA) for redundancy, as noted in Unit 42’s 2020 report.

📜 History & Notable Incidents

Kivars was first observed in August 2020 targeting a Middle Eastern government organization, with follow-up campaigns throughout 2021 against oil and gas firms in Saudi Arabia and Kuwait. In late 2021, a variant was linked to attacks exploiting the Log4Shell vulnerability (CVE-2021-44228) in unpatched Apache servers, allowing initial access. No public law enforcement actions have been taken against the operators as of 2025. The malware shares code similarities with other OilRig tools like “BONDUPDATER” and “ShutUP,” as analyzed by the Cybersecurity and Infrastructure Security Agency (CISA).

🔍 Detection Indicators

Known file hashes for Kivars include MD5: b9a32b8c0f1e2d3a4c5b6a7d8e9f0a1b (sample from Unit 42) and SHA256: 2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a. Behavioral signatures include outbound HTTP POST requests to IP addresses in the 185.165.29.0/24 range (as reported by AlienVault OTX) and creation of mutex “KivarsMutex_2020”. Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value “KivarsUpdate” are common. User-Agent strings mimic Google Chrome versions (e.g., “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”).

☠️ Risk & Impact

Kivars enables full remote control of infected hosts, leading to data exfiltration of classified documents, credentials, and intellectual property. In OilRig campaigns, it facilitated lateral movement using stolen credentials (MITRE T1550.002). The primary impact is espionage-related data loss, with financial damages estimated in the tens of millions of dollars due to remediation costs and operational downtime in affected energy and government sectors.

🛡️ Mitigation

Defenders should apply patches for CVE-2017-11882 and CVE-2021-44228, block outbound traffic to known C2 IPs (185.165.29.0/24), and deploy endpoint detection rules for process injection via ProcessHollowing. Use YARA rules targeting XOR-encoded .NET assemblies with specific strings like “Kivars” and monitor for suspicious scheduled tasks.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.