Due to the increasing adoption of 64-bit systems, malware authors have begun to adapt and modify their software code to target these specific platforms.
New variants of Kivars - an older malware that was written for 32-bit systems - have been detected, showing a preference for 64-bit machines.
Security researchers at Trend Micro analyzed some samples of the malware and found many commonalities, but also minor differences, compared to the 32-bit versions.
The functionality remains the same: Kivars has options to download/upload data, execute and manipulate files, uninstall malware, intercept photos, enable or disable the built-in logging feature, as well as control input from the mouse and keyboard.
The malware acts as follows:
After executing the malware, which is referred to as TROJ_FAKEWORD.A, two executable files and a Word document are downloaded to the victims' systems. The Word document is used as bait, as it appears harmless at first glance, but in reality it is just another executable.
The latest variants of the malware are based on a modified version of the RC4 algorithm, which incorporates an extra byte.
Communication with the malware's command and control (C&C) servers is also different, as the new Kivars uses a key generated from a random packet, which triggers a response from the remote computer.
The malware then begins sending information about the infected systems, such as the IP address, hostname, operating system version, malware version, keyboard layout, and recent documents or folders on the desktop.
Trend Micro researchers also revealed that the malicious actors behind Kivars are also using PoisonRAT, which belongs to the category of remote access Trojans, in their campaigns.
