Poison IvyMalware
- chymine
- darkmoon
- pivy
- poisonivy
- spivy
PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.From MITRE ATT&CK
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1055Process Injection
“We do not simply rely on naïve approaches like monitoring well-known system call sequences for process injection, but efficiently analyze memory to find all known evasion capabilities.”
- T1055.004Asynchronous Procedure Call
“It then periodically wakes up, using an asynchronous procedure call, and executes a ROP chain to mark its payload as executable before jumping to it.”
- T1055.012Process Hollowing
“PROCESS HOLLOWING”
What the reports say
1 report, newest first · the exact sentence from each-
Hunting In Memory“The venerable Poison Ivy malware uses this technique, which is a big reason why so many APT groups were drawn to it over the years.”
Thanks — we review every report.