LiteDuke — Malware Profile

LiteDuke is a third stage backdoor that was used by APT29, primarily in 2014-2015. LiteDuke used the same dropper as PolyglotDuke, and was found on machines also compromised by MiniDuke.

MITRE ATT&CK techniques (13)

• T1012 Query Registry
• T1016 System Network Configuration Discovery
• T1027.002 Software Packing
• T1027.003 Steganography
• T1033 System Owner/User Discovery
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1105 Ingress Tool Transfer
• T1140 Deobfuscate/Decode Files or Information
• T1497.003 Time Based Checks
• T1518.001 Security Software Discovery
• T1547.001 Registry Run Keys / Startup Folder

Attributed threat actors

• APT29

Read the full analysis on IntelFusions