S0513 LiteDuke

malwareEnterprise

platformsWindows

also known asLiteDuke

LiteDuke is a third stage backdoor that was used by APT29, primarily in 2014-2015. LiteDuke used the same dropper as PolyglotDuke, and was found on machines also compromised by MiniDuke.

techniques used (13)

ATT&CK techniques this enables or maps to.

T1012Query Registry
T1016System Network Configuration Discovery
T1027.002Software Packing
T1027.003Steganography
T1033System Owner/User Discovery
T1070.004File Deletion
T1071.001Web Protocols
T1082System Information Discovery
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1497.003Time Based Checks
T1518.001Security Software Discovery
T1547.001Registry Run Keys / Startup Folder

used by groups (1)

Threat groups associated with this.

G0016APT29

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan