FatDuke

Malware & Tools · FatDuke

· MalwareS0512 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

FatDuke is a backdoor used by APT29 since at least 2016.(Citation: ESET Dukes October 2019)

Tactic Coverage

stealth (8)discovery (6)command and control (4)execution (2)collection (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (21)

T1005Data from Local System

collection

T1008Fallback Channels

command and control

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1027.002Software Packing

stealth

T1027.016Junk Code Insertion

References

https://attack.mitre.org/software/S0512 https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf

T1036.012Browser Fingerprint

stealth

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1090.001Internal Proxy

command and control

T1106Native API

execution

T1140Deobfuscate/Decode Files or Information

stealth

T1218.011Rundll32

stealth

T1497.003Time Based Checks

stealthdiscovery

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1573.001Symmetric Cryptography

command and control