Early Version of MiniDuke Ran on Chinese Time
Bitdefender antimalware researchers have come across samples of a previously-unrecognized version of the MiniDuke virus which, as it turns out, was active as early as May 2012 – and it wants to know what time it is in China.
Previously known variants show a compile time of 20th of February, 2013.The sample was first detected and added to the Bitdefender malware database on 26th of May 2012. In conclusion, the file can be confidently dated to May 2012 or earlier.
Software\Microsoft\Windows NT\CurrentVersion\Winlogon, shell entry:
Unlike the February 2013 samples, it sets an environment variable which contains the path towards the malware. The path where it is stored is identical to the other variants: C:\Documents and Settings\All Users\ and possibly one of the “Application Data” or “Microsoft” subdirectories (picked at random).
The environment variable name can be one of the values :
The .dll copied in the temp path has one of the names: ntuser.dat, registry.dat, index.db, profile.dat, sysdata.dat, config.dat, sysini.dat, bootstat.dat … (see above). By contrast, samples from 2013 concatenate several string chunks, picking from:
“base, user, reg, index, profile, system, data, config, init, boot, stat, cache, class, setup, network.. etc”
and gets run using a .lnk file added to Startup.
the virus accesses http://www.time-server.org/get_time.php?country=China which returns the current time and date in China! If an Internet connection is not present, the system time is used (connection is retried twice every 10 minutes.Although it requests date and time values for China, the malware seems to use only the date(y/m/d), not the time of day.
The time user agent for contacting Google is:
“User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)”
while other variants used different user agents.
Analysis is ongoing but so far it appears that otherwise this sample behaves the same as later ones.
The payload files which are downloaded (.gif) are decrypted and saved under one of the names:
“winupdt.exe wcsntfy.exe netmngr.exe dumpreport.exe taskhosts.exe wupdmngr.exe winhlp.exe dllhosts.exe dxdiagupd.exe dialers.exe netschd.exe connwiz.exe certupdt.exe repfault.exe wuapreport.exe lanmgr.exe”
and is then run with WinExec() if it is an .exe or loaded using LoadLibrary() if it’s a .dll.
Bitdefender antivirus software detects and removes all known variants of MiniDuke. A free stand-alone removal tool is available: [download id=”3800″].
LuminousMoth – PlugX, File Exfiltration and Persistence Revisited
July 21, 2021
How We Tracked a Threat Group Running an Active Cryptojacking Campaign
July 14, 2021
A Note from the Bitdefender Labs Team on Ransomware and Decryptors
May 26, 2021
New Nebulae Backdoor Linked with the NAIKON Group
April 28, 2021
Good riddance, GandCrab! We’re still fixing the mess you left behind.
June 17, 2019