miniduke | jaffacakes118_miniduke[.]dll

General

Target
jaffacakes118_miniduke.dll
Size 18KB
Sample260911-zqrxpsdd67
SHA256 364ebe4f568a0b1c2217fa90e04b4712cdefcda363d99630c39a7b10cf249581
MD5 f51285eee2905acab71f24d9bb607b32
SHA1 bf43d0cd8e6488760031e1e88b7349dde5287584
SHA512 2502e203d864b34d159a3db1ecc9209b4d360d106137b846a9f1a94ffd96b0b08d88aff9c3f60ba40a49f6f166cb3fee1e18cab30ac3bfac8c113d219066eb0b
SSDEEP 384:3QxazldAcojYhSDb5F2OqJB7gF/61Q+pSVgyWg6Xm4:kbYhSDNF2NJUeQ+4VFWg62
TLSH
T1DC828E1364277A9AED06DC38E889C8BB3B9AA1448152C9310E7436523F6E255BF3D7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: MiniDuke
MiniDuke is a highly sophisticated Windows backdoor attributed to APT29 (Cozy Bear).
backdoor miniduke

Detects MiniDuke 1 IoCs

backdoor apt apt29

resource	yara_rule
sample	family_miniduke

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_miniduke.dll

SHA256 364ebe4f568a0b1c2217fa90e04b4712cdefcda363d99630c39a7b10cf249581
MD5 f51285eee2905acab71f24d9bb607b32
SHA1 bf43d0cd8e6488760031e1e88b7349dde5287584
SHA512 2502e203d864b34d159a3db1ecc9209b4d360d106137b846a9f1a94ffd96b0b08d88aff9c3f60ba40a49f6f166cb3fee1e18cab30ac3bfac8c113d219066eb0b
SSDEEP 384:3QxazldAcojYhSDb5F2OqJB7gF/61Q+pSVgyWg6Xm4:kbYhSDNF2NJUeQ+4VFWg62
TLSH
T1DC828E1364277A9AED06DC38E889C8BB3B9AA1448152C9310E7436523F6E255BF3D7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

1

Entry point

16396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths