*UPDATE: fixed 4 hashes – 1 character was missing
*UPDATE: 93deb98d89b8acfa4115ce1ca89ac26a45aae4563c3a454bf8b2a26886f40a46 most likely is a False Positive (FP) and not evil
*UPDATE: 8290b324f5cdb5c3ea17fa48a74bc11c856f0da0b049d07d9316d161f71f26a5 is old miniduke sample from 2013
February, 2013 we conducted research together with Kaspersky Lab on a malware campaign called MiniDuke. The research on the threat has not stopped. In 2014 Eset published MiniDuke still duking it out information on related attacks, which we can confirm and for which we’ve sent out some additional information towards the incident response community.
Lately, F-Secure published on CosmicDuke ( see CosmicDuke – Cosmu with a twist of MiniDuke.
Today, Kaspersky Lab also added more insight ( Miniduke is back: Nemesis Gemina and the Botgen Studio) on the threat.
As the information on the threat is now publicly available, we also release some additional hints that can help you to find infections (indicators of compromise).
Hosts:
194.69.193.147
69.89.31.57
72.167.13.78
192.155.88.252
188.241.115.41
31.44.186.38
94.242.199.88
212.76.128.149
91.224.141.235
199.231.188.109
46.246.120.178
178.21.172.157
188.116.32.164
64.18.143.90
209.99.17.27
212.7.198.107
User names for FTP authentication:
upgor
dlgor
kweku
menelaos
heres
lorine
madonna
johan
horus
lofter
adair
Related file hashes:
8778738067b37380d3d05d3eb6fb39478fc34a209959639db752863ea52776e3
58b6119d24eddc536af94c4cfeb28efe78d42856c8436a69a77fcc9f15414b6c
63035a73a19b2b2033d6ea3a269ba175b3e80ef31b914bb247a829efba30fd01
974e1deb961d2a9228444e02db21943072f981045b026cd171c7ece294351c36
2f7a286504336eb8765e68efbf8447e147585c02066a4f85102f4f6b93bc35cb
bf0d84fdc087c3f37cfab3f0492ec8f04de98e5a4c823d5f60851cc5eef438de
145688e8ebccb088da78216f4661c85e93da376da6ea707bb6b7b746ad47f4e1
880ae80fdc874002a6d9c807802794d4a35c384551d73bb36277b2f1e63d67e2
47f3405ab0da5af125bcc6ebb6d17a1573b090c54d7a0a00630ec170ccc4b9d1
5b50e26a01b320f05d66727e9d220d5858cdac203ff62e4b9ced1cafc2683637
9e3c407d3bbf2a69cf6509994ffb17b45c58c3adaf3dc876b23e7d0575e24ca0
7e371cd323898e403df7a80add34d791e160e443bcd2d02f27ddc0c04ba1bdab
9ce93f04dbb6a3b833f1146a54dadfdc224fdf24e3cca1f8a1eb4e902d597ff6
1fe180e5a40ed462a6544f4e428b996043decfdf863980501c51cbd7e3bd96c6
3161f7389ff0f71484dd8a6e2583cc0ada73f79fd4e6ef8b772fa2a738284d3a
5dc69a1fefa3a050b36a2c3aff037660010824aa5d56a2e03babedd7a53b443e
70fd11726810e30e4dc34a530edf2b349f913b1e492c73eb1115204fcdd3cd59
--> likely False Positive: 93deb98d89b8acfa4115ce1ca89ac26a45aae4563c3a454bf8b2a26886f40a46
c4c4776bed7e69bf8efacb3f6904f8c06889680c590ec728ae59c0ff6e8cfa05
64e3a2bba82027dd6ff631fa5890a7ba8331b62a0a4c0b1ca24d143c2b61c323
9c2562e05eb940ae8d73c9baa7cfe85cb3ec619689227f65e4fbeeb3fec598ad
7d1ca4a7684877753d5f4ca2d7599c7d87f231a7215945ef17447309f25da62a
7e371cd323898e403df7a80add34d791e160e443bcd2d02f27ddc0c04ba1bdab
dad4c4aea24f2bd3e2f4b93bf782ebef70e8fdf930aff25a3e1b85a717314aa0
d19acbc3686e05726ca572ff455519db9d7e0707450a3c9cb804c0f0fe6a0d7a
e94b97716d354a21dcff365e91d2f445fe2cac6a01a38f6dd1c921c57eeafef4
7e9c0bda27bbc80d947bc0c6ce29a19c824288d2b481f92a1637b7b8dfc8b81c
8c6c57f7e9c81fcf194d17a752f8da4295fab5dad8eb79bd289256b9cdb7415e
3f1ec44b421061173f7cbdbe2b4b0ec9457fdb146e126dc2a0763a69a452ce3c
ceff70f02f18ef4c1fa0d1b07b9462e04e57e98c4ea91e6a8ff29478197c4742
4ea49a33977a93aed17fef02a54ee8f6138d005259cf55c32cab3e23480053cf
bdc9c247ad790ec60ffd26455e49425cb1fe32f58623d9ac470a7104a0592dd3
--> This is old miniduke sample 8290b324f5cdb5c3ea17fa48a74bc11c856f0da0b049d07d9316d161f71f26a5
51b4e69183f3d02124f3314cc64a7869425f053d8021c74c12f21d7c2afe2163
bd4928921ddadb44f9f573da61dac034533bf14fe38acd5754f3ccec1d566300
64e3a2bba82027dd6ff631fa5890a7ba8331b62a0a4c0b1ca24d143c2b61c323
14ebcb27436b338d63e731b5c369c5d33c38ce5066f995093bc6826bd799103b
3e889cd495e008760fd12751d6d45cadf8a7280c4545f2ebe469f84b9b77c835
1590bdbaff2c178387e924b689b030057b4cbd2865e9c4dd3886a8791ac8e4ee
cb4fc98f33021ac890e717f8927bfcaddaaacac9bf9be71578c7baaf9f9cbf02