MiniDuke - Revision history

Eric.freyssinet: Text replacement - "=Unknown" to "="

2015-08-08T13:50:33Z

Text replacement - "=Unknown" to "="

← Older revision		Revision as of 13:50, 8 August 2015
Line 7:		Line 7:
	* Related to [[ItaDuke]]		* Related to [[ItaDuke]]
	\|Alias=SandyEva,		\|Alias=SandyEva,
	\|Target=~~Unknown~~		\|Target=
	\|UserAgent=Mozilla/4.0 (compatible; MSIE 7.0; windows NT 5.1; .NET CLR 2.0.50727; .NT CLR 2.0.4506.2151; .N&T CLR 3.5.30729; InfoPath.2)		\|UserAgent=Mozilla/4.0 (compatible; MSIE 7.0; windows NT 5.1; .NET CLR 2.0.50727; .NT CLR 2.0.4506.2151; .N&T CLR 3.5.30729; InfoPath.2)
	\|CCProtocol=Twitter		\|CCProtocol=Twitter
	\|CVE=CVE-2013-0640,		\|CVE=CVE-2013-0640,
	\|Status=~~Unknown~~		\|Status=
	\|BeginYear=2013		\|BeginYear=2013
	\|EndYear=~~Unknown~~		\|EndYear=
	\|Group=Spying		\|Group=Spying
	\|Infrastructure=* Uses twitter predefined accounts for commands (to point at URLs for the C&Cs)		\|Infrastructure=* Uses twitter predefined accounts for commands (to point at URLs for the C&Cs)

Eric.freyssinet at 08:26, 3 August 2015

2015-08-03T08:26:50Z

← Older revision		Revision as of 08:26, 3 August 2015
Line 12:		Line 12:
	\|CVE=CVE-2013-0640,		\|CVE=CVE-2013-0640,
	\|Status=Unknown		\|Status=Unknown
	\|BeginYear=~~Unknown~~		\|BeginYear=2013
	\|EndYear=Unknown		\|EndYear=Unknown
	\|Group=Spying		\|Group=Spying

Eric.freyssinet at 08:25, 3 August 2015

2015-08-03T08:25:24Z

← Older revision		Revision as of 08:25, 3 August 2015
Line 10:		Line 10:
	\|UserAgent=Mozilla/4.0 (compatible; MSIE 7.0; windows NT 5.1; .NET CLR 2.0.50727; .NT CLR 2.0.4506.2151; .N&T CLR 3.5.30729; InfoPath.2)		\|UserAgent=Mozilla/4.0 (compatible; MSIE 7.0; windows NT 5.1; .NET CLR 2.0.50727; .NT CLR 2.0.4506.2151; .N&T CLR 3.5.30729; InfoPath.2)
	\|CCProtocol=Twitter		\|CCProtocol=Twitter
	\|~~MMPC~~=~~Win32/SandyEva~~,		\|CVE=CVE-2013-0640,
	\|Status=Unknown		\|Status=Unknown
	\|BeginYear=Unknown		\|BeginYear=Unknown

Eric.freyssinet at 08:24, 3 August 2015

2015-08-03T08:24:31Z

← Older revision		Revision as of 08:24, 3 August 2015
Line 6:		Line 6:
	* Kaspersky identified 59 unique victims in 23 countries (Belgium, Brazil, Bulgaria, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Latvia, Lebanon, Lithuania, Montenegro, Portugal, Romania, Russian Federation, Slovenia, Spain, Turkey, Ukraine, United Kingdom and United States)		* Kaspersky identified 59 unique victims in 23 countries (Belgium, Brazil, Bulgaria, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Latvia, Lebanon, Lithuania, Montenegro, Portugal, Romania, Russian Federation, Slovenia, Spain, Turkey, Ukraine, United Kingdom and United States)
	* Related to [[ItaDuke]]		* Related to [[ItaDuke]]
	\|~~Infrastructure~~=* Uses twitter predefined accounts for commands (to point at URLs for the C&Cs)		\|Alias=SandyEva,
	* As an alternative to Twitter, ~~can use Google Search, looking for the string: "lUFEfiHKljfLKWPR", "HkyeiIDKiroLaKYr", "lUFEfiHKDroLaKYr"...~~		\|Target=Unknown
	* An index.php on the found server delivers a GIF file with encrypted content embedded
	\|UserAgent=Mozilla/4.0 (compatible; MSIE 7.0; windows NT 5.1; .NET CLR 2.0.50727; .NT CLR 2.0.4506.2151; .N&T CLR 3.5.30729; InfoPath.2)		\|UserAgent=Mozilla/4.0 (compatible; MSIE 7.0; windows NT 5.1; .NET CLR 2.0.50727; .NT CLR 2.0.4506.2151; .N&T CLR 3.5.30729; InfoPath.2)
	\|CCProtocol=Twitter		\|CCProtocol=Twitter
	\|~~CC2~~=~~HTTP~~		\|MMPC=Win32/SandyEva,
	~~\|Target=Unknown~~
	\|Status=Unknown		\|Status=Unknown
	\|BeginYear=Unknown		\|BeginYear=Unknown
	\|EndYear=Unknown		\|EndYear=Unknown
	\|Group=Spying		\|Group=Spying
			\|Infrastructure=* Uses twitter predefined accounts for commands (to point at URLs for the C&Cs)
			* As an alternative to Twitter, can use Google Search, looking for the string: "lUFEfiHKljfLKWPR", "HkyeiIDKiroLaKYr", "lUFEfiHKDroLaKYr"...
			* An index.php on the found server delivers a GIF file with encrypted content embedded
			\|CC2=HTTP
	\|Victime4=		\|Victime4=
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-04T22:03:30Z

1 revision imported

New page

{{Botnet
|Introduction=* Infection by a crafted PDF file ([[cve::CVE-2013-0640]])
* 20 kB downloader (crafted each time specifically for the attacked systems), which calculates a unique fingerprint that is also used for encryption
* Receives encrypted backdoors obfuscated within GIF files
* Which then fetch a larger backdoor that carries out the actual spying activities
* Kaspersky identified 59 unique victims in 23 countries (Belgium, Brazil, Bulgaria, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Latvia, Lebanon, Lithuania, Montenegro, Portugal, Romania, Russian Federation, Slovenia, Spain, Turkey, Ukraine, United Kingdom and United States)
* Related to [[ItaDuke]]
|Infrastructure=* Uses twitter predefined accounts for commands (to point at URLs for the C&Cs)
* As an alternative to Twitter, can use Google Search, looking for the string: "lUFEfiHKljfLKWPR", "HkyeiIDKiroLaKYr", "lUFEfiHKDroLaKYr"...
* An index.php on the found server delivers a GIF file with encrypted content embedded
|UserAgent=Mozilla/4.0 (compatible; MSIE 7.0; windows NT 5.1; .NET CLR 2.0.50727; .NT CLR 2.0.4506.2151; .N&T CLR 3.5.30729; InfoPath.2)
|CCProtocol=Twitter
|CC2=HTTP
|Target=Unknown
|Status=Unknown
|BeginYear=Unknown
|EndYear=Unknown
|Group=Spying
|Victime4=
}}