1. Home
  2. Software
  3. FatDuke

FatDuke

FatDuke is a backdoor used by APT29 since at least 2016.[1]

ID: S0512
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 24 September 2020
Last Modified: 16 October 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

FatDuke can copy files and directories from a compromised host.[1]
Enterprise T1090 .001 代理: Internal Proxy

FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.[1]
Enterprise T1036 伪装

FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.[1]
Enterprise T1573 .001 加密通道: Symmetric Cryptography

FatDuke can AES encrypt C2 communications.[1]
Enterprise T1140 反混淆/解码文件或信息

FatDuke can decrypt AES encrypted C2 communications.[1]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.[1]
Enterprise T1059 .001 命令与脚本解释器: PowerShell

FatDuke has the ability to execute PowerShell scripts.[1]
Enterprise T1008 回退信道

FatDuke has used several C2 servers per targeted organization.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

FatDuke can be controlled via a custom C2 protocol over HTTP.[1]
Enterprise T1083 文件和目录发现

FatDuke can enumerate directories on target machines.[1]
Enterprise T1106 本机API

FatDuke can call ShellExecuteW to open the default browser on the URL localhost.[1]
Enterprise T1012 查询注册表

FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.[1]
Enterprise T1027 混淆文件或信息

FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.[1]
.001 Binary Padding

FatDuke has been packed with junk code and strings.[1]
.002 Software Packing

FatDuke has been regularly repacked by its operators to create large binaries and evade detection.[1]
Enterprise T1070 .004 移除指标: File Deletion

FatDuke can secure delete its DLL.[1]
Enterprise T1218 .011 系统二进制代理执行: Rundll32

FatDuke can execute via rundll32.[1]
Enterprise T1082 系统信息发现

FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.[1]
Enterprise T1016 系统网络配置发现

FatDuke can identify the MAC address on the target computer.[1]
Enterprise T1497 .003 虚拟化/沙盒规避: Time Based Evasion

FatDuke can turn itself on or off at random intervals.[1]
Enterprise T1057 进程发现

FatDuke can list running processes on the localhost.[1]

Groups That Use This Software

ID Name References
G0016 APT29

[1][2]

Campaigns

ID Name Description
C0023 Operation Ghost

For Operation Ghost, APT29 used FatDuke as a third-stage backdoor.[1]

References

  1. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  1. Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022.