F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
Not cited by any technique.
None recorded.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1005 Data from Local System |
MalwareCosmicDuke | CosmicDuke steals user files from local hard drives with file extensions that match a predefined list. |
| T1020 Automated Exfiltration |
MalwareCosmicDuke | CosmicDuke exfiltrates collected files automatically over FTP to remote servers. |
| T1025 Data from Removable Media |
MalwareCosmicDuke | CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list. |
| T1039 Data from Network Shared Drive |
MalwareCosmicDuke | CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list. |
| T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol |
MalwareCosmicDuke | CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers. |
| T1053.005 Scheduled Task |
MalwareCosmicDuke | CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence. |
| T1071.001 Web Protocols |
MalwareCosmicDuke | CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers. |
| T1083 File and Directory Discovery |
MalwareCosmicDuke | CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list. |
| T1113 Screen Capture |
MalwareCosmicDuke | CosmicDuke takes periodic screenshots and exfiltrates them. |
| T1114.001 Local Email Collection |
MalwareCosmicDuke | CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration. |
| T1115 Clipboard Data |
MalwareCosmicDuke | CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds. |
| T1543.003 Windows Service |
MalwareCosmicDuke | CosmicDuke uses Windows services typically named "javamtsup" for persistence. |
| T1573.001 Symmetric Cryptography |
MalwareCosmicDuke | CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
