MiniDuke
MiniDuke is malware that was used by APT29 from 2010 to 2015. The MiniDuke toolset consists of multiple downloader and backdoor components. The loader has been used with other MiniDuke components as well as in conjunction with CosmicDuke and PinchDuke. [1]
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1543 | Create or Modify System Process | ||
Enterprise | T1568 | .002 | Dynamic Resolution: Domain Generation Algorithms |
MiniDuke can use DGA to generate new Twitter URLs for C2.[2] |
Enterprise | T1008 | Fallback Channels |
MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.[3] |
|
Enterprise | T1083 | File and Directory Discovery | ||
Enterprise | T1105 | Ingress Tool Transfer |
MiniDuke can download additional encrypted backdoors onto the victim via GIF files.[3][2] |
|
Enterprise | T1027 | Obfuscated Files or Information |
MiniDuke can use control flow flattening to obscure code.[2] |
|
Enterprise | T1090 | .001 | Proxy: Internal Proxy |
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.[2] |
Enterprise | T1082 | System Information Discovery |
MiniDuke can gather the hostname on a compromised machine.[2] |
|
Enterprise | T1102 | .001 | Web Service: Dead Drop Resolver |
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.[1][3][2] |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0016 | APT29 |