PolyglotDuke — Malware Profile

PolyglotDuke is a downloader that has been used by APT29 since at least 2013. PolyglotDuke has been used to drop MiniDuke.

MITRE ATT&CK techniques (10)

• T1027 Obfuscated Files or Information
• T1027.003 Steganography
• T1027.011 Fileless Storage
• T1071.001 Web Protocols
• T1102.001 Dead Drop Resolver
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1112 Modify Registry
• T1140 Deobfuscate/Decode Files or Information
• T1218.011 Rundll32

Attributed threat actors

• APT29

Read the full analysis on IntelFusions