Kevin

Malware & Tools · Kevin

· MalwareS1020 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Kevin is a backdoor implant written in C++ that has been used by HEXANE since at least June 2020, including in operations against organizations in Tunisia.(Citation: Kaspersky Lyceum October 2021)

Tactic Coverage

command and control (7)stealth (5)discovery (3)collection (2)exfiltration (2)execution (2)privilege escalation (1)persistence (1)

Used By (1 groups)

G1001HEXANELyceum, Siamesekitten

Techniques (21)

T1001.001Junk Data

command and control

T1005Data from Local System

collection

T1008Fallback Channels

command and control

T1016System Network Configuration Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1030Data Transfer Size Limits

exfiltration

T1036.003Rename Legitimate Utilities

References

https://attack.mitre.org/software/S1020 https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf