Poison Ivy

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Poison Ivy
Alias
Group	RAT, Spying
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns: APT1
Target	Microsoft Windows
Origin
Distribution vector
UserAgent
CCProtocol	TCP/3360 (Port)
Activity	/
Status
Language
Programming language
Operation/Working group

Publications

	Author	Editor	Year
APT1: technical backstage	Malware.lu Paul Rascagnères	Malware.lu	2013
Department of Labor strategic web compromise	Matt Dahl	Crowdstrike	2013
Poison Ivy 2.3.0 Documentation	Shapeless	PoisonIvy	2007
Poison Ivy: assessing damage and extracting intelligence	FireEye	FireEye	2014
PoisonIvy adapts to communicate through authentication proxies	Shusei Tomonaga	JPCERT-CC	2015

• Serveur Buffer Overflow (exploit Metasploit) pour la version 2.3.2 : http://www.metasploit.com/modules/exploit/windows/misc/poisonivy_bof
• Script nmap pour détecter la présence de PoisonIvy : http://alienvault-labs-garage.googlecode.com/files/poison_ivy.nse