miniduke | 2ae4cc6834e3679e99fc93d2f5fba02167a31cf5b68a5a9ca7aa1a4b9f7cb4ae

General

Target
2ae4cc6834e3679e99fc93d2f5fba02167a31cf5b68a5a9ca7aa1a4b9f7cb4ae
Size 24KB
Sample260604-stc5dshw51
SHA256 2ae4cc6834e3679e99fc93d2f5fba02167a31cf5b68a5a9ca7aa1a4b9f7cb4ae
MD5 270ca8368cd4216b1813281d3efe485d
SHA1 b27f6174173e71dc154413a525baddf3d6dea1fd
SHA512 558d645689ef4270de1d3116e0c05d09aab456e8346a6508da6f8bcd134bccc5c50b65ffe6c34ea08d57cd1aef096c97c0aba70ed64907c8b923785f8a941a84
SSDEEP 384:is7bSMmpLxIWfMg076YZvj/ef+MBf59cvOE2m1+qIopwtAYnEb0:P7SRfEGsaf+w5evOEzQqffY
TLSH
T1F3B29D1C8B961E69EA783BB300CE9E64BA7B64F43CB05654DB4C18711303397B6F9535
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: MiniDuke
MiniDuke is a highly sophisticated Windows backdoor attributed to APT29 (Cozy Bear).
backdoor miniduke

Detects MiniDuke 1 IoCs

backdoor apt apt29

resource	yara_rule
sample	family_miniduke

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ae4cc6834e3679e99fc93d2f5fba02167a31cf5b68a5a9ca7aa1a4b9f7cb4ae

SHA256 2ae4cc6834e3679e99fc93d2f5fba02167a31cf5b68a5a9ca7aa1a4b9f7cb4ae
MD5 270ca8368cd4216b1813281d3efe485d
SHA1 b27f6174173e71dc154413a525baddf3d6dea1fd
SHA512 558d645689ef4270de1d3116e0c05d09aab456e8346a6508da6f8bcd134bccc5c50b65ffe6c34ea08d57cd1aef096c97c0aba70ed64907c8b923785f8a941a84
SSDEEP 384:is7bSMmpLxIWfMg076YZvj/ef+MBf59cvOE2m1+qIopwtAYnEb0:P7SRfEGsaf+w5evOEzQqffY
TLSH
T1F3B29D1C8B961E69EA783BB300CE9E64BA7B64F43CB05654DB4C18711303397B6F9535
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

1

Major OS version

5

Entry point

8192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths