Malware: MiniDuke

Description

[MiniDuke](https://attack.mitre.org/software/S0051) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2010 to 2015. The [MiniDuke](https://attack.mitre.org/software/S0051) toolset consists of multiple downloader and backdoor components. The loader has been used with other [MiniDuke](https://attack.mitre.org/software/S0051) components as well as in conjunction with [CosmicDuke](https://attack.mitre.org/software/S0050) and [PinchDuke](https://attack.mitre.org/software/S0048). (Citation: F-Secure The Dukes)

External References

• mitre-attack
• F-Secure The Dukes

Techniques Used by This Malware

• T1008 — Fallback Channels
• T1027 — Obfuscated Files or Information
• T1071.001 — Web Protocols
• T1082 — System Information Discovery
• T1083 — File and Directory Discovery
• T1090.001 — Internal Proxy
• T1102.001 — Dead Drop Resolver
• T1105 — Ingress Tool Transfer
• T1568.002 — Domain Generation Algorithms

APT Groups Using This Malware

• APT29