LiteDuke

Malware & Tools · LiteDuke

· MalwareS0513 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

LiteDuke is a third stage backdoor that was used by APT29, primarily in 2014-2015. LiteDuke used the same dropper as PolyglotDuke, and was found on machines also compromised by MiniDuke.(Citation: ESET Dukes October 2019)

Tactic Coverage

discovery (6)stealth (5)command and control (2)persistence (1)privilege escalation (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (13)

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1027.002Software Packing

stealth

T1027.003Steganography

stealth

T1033System Owner/User Discovery

discovery

T1070.004File Deletion

stealth

T1071.001Web Protocols

References

https://attack.mitre.org/software/S0513 https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf