Top Posts Tagged with #geminiduke

GeminiDuke

GeminiDuke was developed and deployed around the same time as PinchDuke and CosmicDuke. Unlike its sister campaigns, the January 2009 – December 2012 GeminiDuke campaign focused on collecting system configuration information from infected hosts. Samples of the GeminiDuke malware were compiled in UTC+3 and UTC+4 (depending upon the season), which corresponds to Moscow Standard Time during Daylight Savings Time. Like PinchDuke and CosmicDuke, GeminiDuke was designed around a core information stealer component. The malware consisted of a loader, an information stealer, and numerous persistence components. The information stealer used a mutex based around a timestamp to ensure that only one instance of the malware was running at a time. The information stealer enumerates: local user accounts, network settings, internet proxy settings, installed drivers, running processes, values of environment variables, programs that run at startup, programs previously executed by the users, programs installed in the Programs Files folder, the files and folders in the users’ home folder, the files and folders in the users’ My Documents folder, and recently accessed files, folders, and programs. The malware employs multiple persistence components similar to those included in CosmicDuke. MiniDuke’s backdoor component resembles the source code behind one of GeminiDuke’s persistence modules.

informationstealer

#mutex #informationstealer #cosmicduke #pinchduke #geminiduke

•18+ Adults Only

Watch Anya Live on Cam

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.

✓ Live Streaming✓ Interactive Chat✓ Private Shows✓ HD Quality✓ Free Actions

Free to watch • No registration required • HD streaming

CosmicDuke

CosmicDuke is believed to have been developed and deployed by the same team as PinchDuke. It was compiled on January 16, 2010 and was still active as of June 2015. It superseded the PinchDuke campaign and its toolkit surpasses the functionality of the PinchDuke exploit kit. Unlike PinchDuke, CosmicDuke appears to be entirely custom written to the adversary’s specifications. The techniques that CosmicDuke uses to extract user credentials and detect analysis tools may be based on pinchduke. At a high-level, CosmicDuke’s persistence techniques resemble those of GeminiDuke. Despite the similarities to the other Duke malware, CosmicDuke does not share any code with its sibling campaigns. CosmicDuke was most famously deployed against individuals believed to be trafficking illicit substances in Russia. It is possible that Russia’s law enforcement agencies used the malware as spyware in their war against drugs. It deploys from a series of loaders and the malware is built around an information stealer that is augmented by persistence components and a privilege escalation tool. Early variants of the privilege escalation module attempted to exploit CVE-2010-0232 or CVE-2010-4398. The malware authors likely chose which persistence and escalation tools to include in each variant of the malware in order to exploit known vulnerabilities in the target environment. For instance, in 2014, after the exposure of MiniDuke, Kaspersky noted the appearance of a CosmicDuke variant that featured a backdoor and the ability to start via Windows Task Scheduler.

#cosmicduke #geminiduke #pinchduke #pinchdukecampaign

GeminiDuke, 3 Minute Profile

GeminiDuke, like PinchDuke and CosmicDuke, was designed around a core information stealer component. The malware consisted of a loader, an information stealer, and numerous persistence components. The information stealer used a mutex based around a timestamp to ensure that only one instance of the malware was running at a time. The information stealer enumerates: local user accounts, network settings, internet proxy settings, installed drivers, running processes, values of environment variables, programs that run at startup, programs previously executed by the users, programs installed in the Programs Files folder, the files and folders in the users’ home folder, the files and folders in the users’ My Documents folder, and recently accessed files, folders, and programs. The malware employs multiple persistence components similar to those included in cosmicduke. MiniDuke’s backdoor component resembles the source code behind one of GeminiDuke’s persistence modules.

#informationstealer #geminiduke #pinchduke

GeminiDuke

GeminiDuke was developed and deployed around the same time as PinchDuke and CosmicDuke. Unlike its sister campaigns, the January 2009 – December 2012 GeminiDuke campaign focused on collecting system configuration information from infected hosts. Samples of the GeminiDuke malware were compiled in UTC+3 and UTC+4 (depending upon the season), which corresponds to Moscow Standard Time during Daylight Savings Time. Like PinchDuke and CosmicDuke, GeminiDuke was designed around a core information stealer component. The malware consisted of a loader, an information stealer, and numerous persistence components. The information stealer used a mutex based around a timestamp to ensure that only one instance of the malware was running at a time. The information stealer enumerates: local user accounts, network settings, internet proxy settings, installed drivers, running processes, values of environment variables, programs that run at startup, programs previously executed by the users, programs installed in the Programs Files folder, the files and folders in the users’ home folder, the files and folders in the users’ My Documents folder, and recently accessed files, folders, and programs. The malware employs multiple persistence components similar to those included in CosmicDuke. MiniDuke’s backdoor component resembles the source code behind one of GeminiDuke’s persistence modules.

informationstealer

#mutex #informationstealer #cosmicduke #pinchduke #geminiduke

Trending Tags

Last Seen Tags

#geminiduke

Trending Tags

Last Seen Tags

#geminiduke