RAT
Vyveva RAT
Vyveva is a remote access trojan that uses the Tor library for communication with C&C.
Vyveva RAT is a Windows rat operated by Lazarus Group.
Background
Vyveva is a remote access trojan that relies on the Tor library to reach its C&C. Disguising its network traffic with fake TLS is a hallmark of Lazarus tooling.
For both its configuration and its network traffic, it applies a straightforward XOR scheme.
It transmits a thorough profile of the victim's machine, covering the computer name, user name, IP, code page, Windows version, architecture, and time zone.
The backdoor implements over 20 commands, spanning filesystem operations, basic process handling, command line execution, file exfiltration, and downloading plus in-memory execution of an extra DLL from the C&C (via the expected export SamIPromote). Consistent with many Lazarus RATs, commands are referenced by 32-bit integer indices, starting at the lowest value 0x3, then 0x10, and rising step by step to 0x26. It can additionally watch for newly attached drives and track how many users are logged on.
Its internal DLL name is MPRD.dll, and it exposes a single export, SamIInitialize.
Vyveva RAT featured in a June 2020 attack on a freight logistics firm based in South Africa.
Source: Malpedia (Fraunhofer FKIE).