Check out the results from our first round of ATT&CK Evaluations at attackevals.mitre.org!
SOFTWARE Overview 3PARA RAT 4H RAT adbupd Adups ADVSTORESHELL Agent.btz Allwinner Android Overlay Malware Android/Chuli.A ANDROIDOS_ANSERVER.A AndroRAT Arp ASPXSpy at AutoIt backdoor Backdoor.Oldrea BACKSPACE BADCALL BADNEWS Bandook Bankshot BBSRAT BISCUIT Bisonal BITSAdmin BLACKCOFFEE BlackEnergy BOOTRASH BrainTest Brave Prince Briba BS2005 BUBBLEWRAP Cachedump CALENDAR Calisto CallMe Carbanak Catchamas CCBkdr certutil Chaos Charger ChChes Cherry Picker China Chopper CHOPSTICK CloudDuke cmd Cobalt Strike Comnie ComRAT CORALDECK CORESHELL CosmicDuke CozyCar Crimson CrossRAT Daserf DDKONG DealersChoice Dendroid Derusbi Dipsind DOGCALL Dok Downdelph DownPaper DressCode DroidJack dsquery DualToy Duqu DustySky Dyre Elise ELMER Emissary Epic EvilGrab FakeM FALLCHILL Felismus FELIXROOT Fgdump FinFisher Flame FLASHFLOOD FLIPSIDE Forfiles FruitFly FTP Gazer GeminiDuke gh0st GLOOXMAIL Gold Dragon Gooligan GravityRAT gsecdump H1N1 Hacking Team UEFI Rootkit HALFBAKED HAMMERTOSS HAPPYWORK HARDRAIN Havij hcdLoader HDoor Helminth Hi-Zor HIDEDRV Hikit HOMEFRY HTRAN HTTPBrowser httpclient HummingBad HummingWhale Hydraq ifconfig iKitten InnaputRAT InvisiMole Invoke-PSImage ipconfig ISMInjector Ixeshe Janicab JHUHUGIT JPIN jRAT Judy KARAE Kasidet Kazuar Keydnap KEYMARBLE KeyRaider Koadic Komplex KOMPROGO Kwampirs Linfo LOWBALL Lslsass Lurid MacSpy Marcher Matroyshka MazarBOT meek Mimikatz MimiPenguin Miner-C MiniDuke MirageFox Mis-Type Misdat Mivast MobileOrder MoonWind More_eggs Mosquito MURKYTOP Naid NanHaiShu NavRAT nbtstat NDiskMonitor Nerex Net Net Crawler NETEAGLE netsh netstat NetTraveler NETWIRE Nidiran NotCompatible OBAD OLDBAIT OldBoot OnionDuke OopsIE Orz OSInfo OwaAuth P2P ZeuS Pasam Pass-The-Hash Toolkit Pegasus for Android Pegasus for iOS PHOREAL PinchDuke Ping Pisloader PJApps PLAINTEE PlugX pngdowner PoisonIvy POORAIM POSHSPY Power Loader PowerDuke POWERSOURCE PowerSploit POWERSTATS POWRUNER Prikormka Proton Proxysvc PsExec Psylo Pteranodon PUNCHBUGGY PUNCHTRACK Pupy pwdump QUADAGENT QuasarRAT RARSTONE RATANKBA RawPOS RCSAndroid Reaver RedDrop RedLeaves Reg Regin RemoteCMD Remsec Responder RGDoor RIPTIDE ROCKBOOT RogueRobin ROKRAT route Rover RTM RuMMS RunningRAT S-Type Sakula schtasks SDelete SeaDuke SEASHARPEE Shamoon ShiftyBug SHIPSHAPE SHOTPUT SHUTTERSPEED Skeleton Key Skygofree SLOWDRIFT Smoke Loader SNUGRIDE Socksbot SOUNDBITE SPACESHIP spwebmember SpyDealer SpyNote RAT sqlmap SslMM Starloader Stealth Mango StreamEx Sykipot SynAck Sys10 Systeminfo T9000 Taidoor Tangelo Tasklist TDTESS TEXTMATE TINYTYPHON TinyZBot Tor TrickBot Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst.a Trojan-SMS.AndroidOS.OpFake.a Trojan.Karagany Trojan.Mebromi Truvasys TURNEDUP Twitoor TYPEFRAME UACMe Umbreon Unknown Logger UPPERCUT Uroburos USBStealer Vasport VERMIN Volgmer WEBC2 Wiarp Windows Credential Editor WINDSHIELD WINERACK Winexe Wingbird WinMM Winnti Wiper WireLurker X-Agent for Android XAgentOSX Xbot xCmd XcodeGhost XLoader XTunnel YiSpecter yty Zebrocy ZergHelper Zeroaccess ZeroT ZLib
  1. Home
  2. Software
  3. PowerDuke

PowerDuke

PowerDuke is a backdoor that was used by APT29 in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros. [1]

ID: S0139
Aliases: PowerDuke
Type: MALWARE
Platforms: Windows

Version: 1.0

Alias Descriptions

NameDescription
PowerDuke[1]

Techniques Used

DomainIDNameUse
EnterpriseT1010Application Window DiscoveryPowerDuke has a command to get text of the current foreground window.[1]
EnterpriseT1059Command-Line InterfacePowerDuke runs cmd.exe /c and sends the output to its C2.[1]
EnterpriseT1043Commonly Used PortPowerDuke connects over 443 for C2.[1]
EnterpriseT1083File and Directory DiscoveryPowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.[1]
EnterpriseT1107File DeletionPowerDuke has a command to write random data across a file and delete it.[1]
EnterpriseT1096NTFS File AttributesPowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).[1]
EnterpriseT1027Obfuscated Files or InformationPowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).[1]
EnterpriseT1057Process DiscoveryPowerDuke has a command to list the victim's processes.[1]
EnterpriseT1060Registry Run Keys / Startup FolderPowerDuke achieves persistence by using various Registry Run keys.[1]
EnterpriseT1105Remote File CopyPowerDuke has a command to download a file.[1]
EnterpriseT1085Rundll32PowerDuke uses rundll32.exe to load.[1]
EnterpriseT1082System Information DiscoveryPowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.[1]
EnterpriseT1016System Network Configuration DiscoveryPowerDuke has a command to get the victim's domain and NetBIOS name.[1]
EnterpriseT1033System Owner/User DiscoveryPowerDuke has commands to get the current user's name and SID.[1]
EnterpriseT1124System Time DiscoveryPowerDuke has commands to get the time the machine was built, the time, and the time zone.[1]

Groups

Groups that use this software:

APT29

References

  1. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.