#informationstealer

[jmj973]

GeminiDuke

GeminiDuke was developed and deployed around the same time as PinchDuke and CosmicDuke. Unlike its sister campaigns, the January 2009 – December 2012 GeminiDuke campaign focused on collecting system configuration information from infected hosts. Samples of the GeminiDuke malware were compiled in UTC+3 and UTC+4 (depending upon the season), which corresponds to Moscow Standard Time during Daylight Savings Time. Like PinchDuke and CosmicDuke, GeminiDuke was designed around a core information stealer component. The malware consisted of a loader, an information stealer, and numerous persistence components. The information stealer used a mutex based around a timestamp to ensure that only one instance of the malware was running at a time. The information stealer enumerates: local user accounts, network settings, internet proxy settings, installed drivers, running processes, values of environment variables, programs that run at startup, programs previously executed by the users, programs installed in the Programs Files folder, the files and folders in the users’ home folder, the files and folders in the users’ My Documents folder, and recently accessed files, folders, and programs. The malware employs multiple persistence components similar to those included in CosmicDuke. MiniDuke’s backdoor component resembles the source code behind one of GeminiDuke’s persistence modules.

informationstealer

[fatcashmoney]

Santa APT

Cloudsek, a Canadian Cyber Security firm, detected the activity of a suspected criminal advanced persistent threat group over the 2015 holiday season. The group, dubbed Santa APT because some of their malware masqueraded as Santa Claus applications, steals intellectual property for economic gain. Cloudsek believes that the malware developers are located in South Asia.The group came to the attention of security professionals who noticed them selling information stealer malware, capable of jumping air gapped systems, on underground markets. The attackers were using the malware to steal classified data from software companies and government organizations. The malware collects files and screenshots and stores them in hidden files on any connected USB device. When the device is connected to an internet enabled system, the data is sent back to command and control infrastructure located in Germany. Empty voice recording and key log files on the C2C servers suggest that the malware is still under development. Cloudsek claims to have found the malware attributed to the group masquerading as Santa Claus mobile games, which had infected about 8000 systems. The malware stole contact lists, SMS messages, call records, location information, calendars, pictures, video, environment readings, camera specifications, browser history, program information, sim card information, and device status. The mobile malware communicated with the C2C infrastructure via HTTP about once a minute. The C2C servers corresponding to the mobile infrastructure had separate login sections for user profiles and for administrative profiles. The victim information was organized according to user and then according to data type. The attacker could also arm the malware to send them an SMS alert if the victim left a regional area. This could allow the actor to track whether a victim has left home or the office, in real time. The adversary could also receive regular updates if a particular victim received an SMS message or phone call.

SANTAAPT

[happyhomedecoration]

GeminiDuke, 3 Minute Profile

GeminiDuke, like PinchDuke and CosmicDuke, was designed around a core information stealer component. The malware consisted of a loader, an information stealer, and numerous persistence components. The information stealer used a mutex based around a timestamp to ensure that only one instance of the malware was running at a time. The information stealer enumerates: local user accounts, network settings, internet proxy settings, installed drivers, running processes, values of environment variables, programs that run at startup, programs previously executed by the users, programs installed in the Programs Files folder, the files and folders in the users’ home folder, the files and folders in the users’ My Documents folder, and recently accessed files, folders, and programs. The malware employs multiple persistence components similar to those included in cosmicduke. MiniDuke’s backdoor component resembles the source code behind one of GeminiDuke’s persistence modules.

[blogpravinjadhav]

GeminiDuke

GeminiDuke was developed and deployed around the same time as PinchDuke and CosmicDuke. Unlike its sister campaigns, the January 2009 – December 2012 GeminiDuke campaign focused on collecting system configuration information from infected hosts. Samples of the GeminiDuke malware were compiled in UTC+3 and UTC+4 (depending upon the season), which corresponds to Moscow Standard Time during Daylight Savings Time. Like PinchDuke and CosmicDuke, GeminiDuke was designed around a core information stealer component. The malware consisted of a loader, an information stealer, and numerous persistence components. The information stealer used a mutex based around a timestamp to ensure that only one instance of the malware was running at a time. The information stealer enumerates: local user accounts, network settings, internet proxy settings, installed drivers, running processes, values of environment variables, programs that run at startup, programs previously executed by the users, programs installed in the Programs Files folder, the files and folders in the users’ home folder, the files and folders in the users’ My Documents folder, and recently accessed files, folders, and programs. The malware employs multiple persistence components similar to those included in CosmicDuke. MiniDuke’s backdoor component resembles the source code behind one of GeminiDuke’s persistence modules.

informationstealer