SeaDuke

SeaDuke is malware that was used by APT29 from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with CozyCar. [1]

ID: S0053
Associated Software: SeaDaddy, SeaDesk
Type: MALWARE
Platforms: Windows
Version: 1.0

Techniques Used

Domain ID Name Use
Enterprise T1059 Command-Line Interface SeaDuke is capable of executing commands.[2]
Enterprise T1002 Data Compressed SeaDuke compressed data with zlib prior to sending it over C2.[3]
Enterprise T1132 Data Encoding SeaDuke C2 traffic is base64-encoded.[2]
Enterprise T1114 Email Collection Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.[4]
Enterprise T1107 File Deletion SeaDuke can securely delete files, including deleting itself from the victim.[4]
Enterprise T1097 Pass the Ticket Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.[4]
Enterprise T1086 PowerShell SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[4]
Enterprise T1060 Registry Run Keys / Startup Folder SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.[2]
Enterprise T1105 Remote File Copy SeaDuke is capable of uploading and downloading files.[2]
Enterprise T1064 Scripting SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[4]
Enterprise T1023 Shortcut Modification SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.[2]
Enterprise T1045 Software Packing SeaDuke has been packed with the UPX packer.[2]
Enterprise T1071 Standard Application Layer Protocol SeaDuke uses HTTP and HTTPS for C2.[1]
Enterprise T1032 Standard Cryptographic Protocol SeaDuke C2 traffic has been encrypted with RC4 and AES.[3][2]
Enterprise T1078 Valid Accounts Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.[4]
Enterprise T1084 Windows Management Instrumentation Event Subscription SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.[5]

Groups

Groups that use this software:

APT29

References