COSMICDUKE
Cosmu with a twist of MiniDuke
TLP: WHITECONTENTSINTRODUCTION2
Scope2
Target2
Arrival3
Infection3
Data theft 
3Data transmission
3
TECHNICAL DETAILS
4
Dropper: RLO4
Dropper: Decoys
5
Exploit6
Loader: MiniDuke 3rd Stage
6
Main Component: Info-stealer
7
RC4 Encryption
9
Samples Comparison
9
APPENDIX A | SAMPLES
13
APPENDIX B | SERVERS
15

In this document we report on our analysis of
CosmicDuke - the first malware seen to include
code from both the notorious MiniDuke APT trojan
and another longstanding threat, the informationstealing Cosmu family. When active on an infected
machine, CosmicDuke will search for and harvest
login details from a range of programs and forward
the data to remote servers, some of which wereactive at the time of writing.

F-SECURE LABS
SECURITY RESPONSE
Malware Analysis
Whitepaper

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

2

FIGURE 1: SIMPLIFIED OVERVIEW OF COSMICDUKE’S CHAIN OF ACTION
Decoy

Dropper

Exploit

MiniDuke
LoaderCosmu
Info-stealer

Attacker

INTRODUCTION
In early 2013, the MiniDuke malware was discovered inuse in a series of attacks against NATO and European
government agencies. While investigating MiniDuke
loaders in April 2014, we were surprised to notice that themalicious executable being decompressed and loaded
into memory was very similar to the Cosmu family of
information-stealers, which we saw as long ago as 2001.
Cosmu is the first malware family we have seen to sharecode with MiniDuke.
This analysis is focused on those Cosmu samples thatshare code with MiniDuke. Some of these are older thanthe oldest publicly documented MiniDuke samples,
implying that the shared code might have been originallyused by Cosmu, not MiniDuke. For convenience, we
decided to name the samples showing this amalgamationof MiniDuke-derived loader and Cosmu-derived payload
CosmicDuke.
The filenames and content used in CosmicDuke’s
attack files to lure victims into opening them containreferences to the countries of Ukraine, Poland, Turkey
and Russia,either generally in use of language or included
detail, or in allusions to events or institutions. The
filenames and content chosen seem to be tailored to theirtarget’s interests, though at the time of writing, we haveno further information on the identity or location of thesevictims.
CosmicDuke infections start by tricking victims into
opening either a PDF file that contains an exploit or a
Windows executable whose filename is manipulated tomake it look like a document or image file.
Once the victim opens the file, the malware gains
persistence on the system and starts collecting
information. The data collection components include akeylogger, clipboard stealer, screenshotter, and password
stealers for a variety of popular chat, email and webbrowsing programs. It also collects information about
the files on the system, and has the capability to export
cryptographic certificates and the associated private keys.
Once the information has been collected, it is sent out toremote servers via FTP. In addition to stealing informationfrom the system, Cosmu allows the attacker to download
and execute other malware on the system.
F-Secure has detections for all the different malicious
components used by the Cosmu variants described in thisreport.

SCOPE
We have seen dozens of Cosmu samples that share codewith MiniDuke. Rather than cover the entire spectrumof samples, the scope of this analysis was intentionallylimited to highlighting the most interesting of therecent samples. This includes examining the attack files
used to infect targets, the remote servers storing datacollected from the victims and the differences between
the MiniDuke loaders and Cosmu info-stealers used in thesamples.

TARGET
This analysis is based on examination of files we gathered
through our sample collection systems. Based on thenature of the filenames and decoy documents used, andthe fact that the MiniDuke loader is known to be used as apart of targeted attacks, we suspect that CosmicDuke may
also be used in such operations. At the time of writing,
we have not identified any victims ourselves, nor are weaware of any public reports confirming this scenario.

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

3

ARRIVAL

DATA THEFT

At this time, we have no information on how theCosmicDuke attack files are delivered to the victims,
though based on the findings from the analysis, we canmake an educated guess.

CosmicDuke’s primary purpose is to steal information. The
different ways it collects information from the infected
machine are as follows:

It is possible that the PDF documents containing exploits
were emailed to the targeted users as file attachments.
Assuming that the email gateway used by the victims does
not include an antivirus solution capable of identifying the
exploit, such files would have little impediment to being
spread by email.

yy Keylogger
yy Taking screenshots
yy Stealing data from clipboard
yy Stealing files
yy Stealing PKI certificates and associated private keys

It is however unlikely that the samples which camouflaged
the executable files as image or document files would
be distributed in the same way. Regardless of any tricks
played with the filenames, the files themselves are
Windows executables, and many email solutions today
prevent users from opening attached executable files.

yy Stealing usernames and passwords from browsers,
instant messengers and email clients

INFECTIONDATA TRANSMISSION

The attackers are using at least two different methods for
infecting the systems: exploits and social engineering.

The information collected by the malware is automaticallyuploaded to remote servers via FTP. Our analysis also
reveals various details of the remote sites contacted by
CosmicDuke, including the login credentials used and the
FTP folder structure.

DOCUMENT-BASED EXPLOIT
CosmicDuke malware samples that use exploits to gain
entry onto a target system (referred to as exploit files
in the rest of this document) start with a maliciousFlash object embedded into a PDF file. When the file islaunched, the object exploits the known CVE-2011-0611
vulnerability in specific versions of Adobe Flash, Reader
and Acrobat products.
Unlike the CosmicDuke files geared towards social
engineering, the exploit files do not actually display
any documents to the user as a form of distraction; themalware simply straightaway exploits the vulnerability.

SOCIAL ENGINEERING
Less technically challenging CosmicDuke samples use
simple social engineering to trick the user into willingly
launching the attack file. Once launched, the file drops
the malware onto the system (such files are therefore
referred to as droppers in the rest of this documents).
To do so, the malware’s executable file is first disguised as
an image or document to make it seem innocuous. Whenlaunched, a document or image is displayed in order todraw the user’s attention away from any background
activity. In the meantime, the malware’s malicious files are
silently installed and executed on the system.

yy Stealing WLAN passwords
yy Stealing Windows password hashes

At the time of writing, most of these remote sites are live.
A list of the servers CosmicDuke malware connects to is
on page 15.

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

4

TECHNICAL DETAILS
CosmicDuke samples can be divided into 3 distinct groups
based on similarities between the C&C servers they
contact, file characteristics and decoy document used.
The full details of how the samples were grouped is listed
on page 11; Figure 2 at left provides a quick summary of thegrouping as they relate to how CosmicDuke is delivered,and the decoy documents shown.
The first group of samples (Group #1) is spread using 3
dropper files that display specific decoy documents. The
second sample group (Group #2) uses both exploit-loaded
files and dropper files. The third group (Group #3) is rather
an exception, as it does not use the droppers or exploits
listed here; for the sake of simplicity, we will exclude
considering Group #3’s delivery method.

FIGURE 2: COSMICDUKE SAMPLESGROUPED BY INFECTION VECTORGROUP #1
DROPPERS:
rcs.Заказ.doc
rcs.18.jpg
rcs.DSC_1365527283.jpg

GROUP #2
EXPLOITS &DROPPERSGROUP #3?

Image 1: Screenshot of folder containing CosmicDuke dropper files

DROPPER: RLO
CosmicDuke’s author(s) disguised the fact that themalware is an executable file by using the Right-to-Left
Override (RLO) feature in Windows to hide the file’s
correct file extension, .exe or .scr, and replace it with .jpg,.pdf or .doc, in order to make the file appear to be an
innocuous document or image.
Image 1 is a screenshot of how the filenames look like inWindows 7. The real file extension for the top four files is.scr, while the real extension for the bottom one is .exe.
Note that the attacker has also carefully changed the iconof the executable to reflect the fake filetype for the first
four.
The bottom file is a curious exception, as it does not use a
PDF icon as would be expected with a .pdf file extension;
instead, it uses an NVIDIA icon, most likely to reflect thefact that the product name of the executable is listed
as “NVIDIA Update Components” in the file’s version
information. This seems to be a common fake productname used in the latest Cosmu samples. Meanwhile, thefilename readily visible to the users is translated from
Turkish as “civilian crisis center status report”.
The use of RLO is a smart move from the attackers. Whygo through the trouble of exploiting anything if you cansimply trick the user into double-clicking an executablethat looks a lot like a document file?
As the screenshot demonstrates, unchecking “Hideextensions for known filetypes” does not help. The threeletter file extensions seen at the end of the filename is not
the real file extension. Even though the information in theType column is correct, most of the users probably do noteven check it.

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

5

DROPPER: DECOYS

Image 2: Decoy shownby rcs.Заказ.doc

CosmicDuke dropper files all display some kind of a decoy
document or image to distract the user when the attack
file is launched.
The following are the droppers used by Group #1. Here are
the filenames of the decoys, as displayed in Windows, andthe decoy images or files they show when launched:
yy rcs.Заказ.doc			
yy rcs.18.jpg 			yy rcs.DSC_1365527283.jpg- Image 2- Image 3- Image 4

The decoys are interesting. Заказ means “order” inRussian. Based on the characters СЖС-1295 and ГХРПfound in the decoy, the document looks like an order for
growth hormones. The document contains full delivery
address, including the name of the person placing theorder.
An interesting detail about the image file of a receipt(Image 3) shown by rcs.18.jpg is that it contains EXIF
metadata, including the date when the photo was taken
and the model of the mobile phone that was used to takethe photo. Part of this EXIF metadata is shown in Image 3a.

Image 3:
Decoy shownby rcs.18.jpg

The third dropper file we’ve seen uses the filename ‘rcs.
Ukraine-Gas-Pipelines-Security-Report-March-2014.pdf’,
and displays the decoy document shown in Image 6. Thisparticular dropper file is notable in that its info-stealer(SHA1:f513b21738ae3083d79e4fa1039889e1c3efff58) is thesame one used by the exploit file named “Bulletin-PISMNo-31-(625)-March-10-2014.pdf”.
Image 3a: EXIF metadata
for file from image 3

Image 6: Decoy document shown by
rcs.Ukraine-Gas-Pipelines-Security-Report-March-2014.pdf

Image 4: Decoy shown by
rcs.DSC_1365527283.jpg

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

6

EXPLOIT

FIGURE 3: FILENAMES AND SHA1 VALUESOF COSMICDUKE EXPLOIT FILES

The code used by CosmicDuke to exploit the CVE-20110611 vulnerability appears to be derived from this proofof-concept code that was made available in early 2011:

Bulletin-PISM-No-31-(625)-March-10-2014.pdf
65681390d203871e9c21c68075dbf38944e782e8
paper_format.pdf
7631f1db92e61504596790057ce674ee90570755

yy http://www.exploit-db.com/exploits/17473/[Unknown]
353540c6619f2bba2351babad736599811d3392e

The samples we analyzed of the exploit-based
CosmicDuke variety had the file names and SHA1 values
listed in Figure 3 at right (see “Appendix A | Samples” formore details).

March.pdf
8949c1d82dda5c2ead0a73b532c4b2e1fbb58a0e

Some of these exploit files have interesting filenames,such as “dip.mail march.pdf” and “Bulletin-PISM-No31-(625)-March-10-2014.pdf”. The PISM mentioned in
the latter presumably refers to the Polish Institute ofInternational Affairs [1].

dip.mail march.pdf
c671786abd87d214a28d136b6bafd4e33ee66951
nota.pdf
5295b09592d5a651ca3f748f0e6401bd48fe7bda

LOADER: MINIDUKE 3RD STAGE
The CosmicDuke samples we analyzed used the same
loader as MiniDuke’s stage 3 [2] samples, making this thefirst occasion in which we’ve seen other malware using
this particular loader.
The parallel usage of the loader in the CosmicDuke and
MiniDuke families is interesting. The oldest samples wehave of this loader that loads Cosmu malware show thecompilation date of the loader as March 24 2011, which
predates the oldest publicly documented MiniDuke
sample (with a recorded loader compilation date ofJune 18 2012). The earlier use of the loader with a Cosmu
payload leads us to suspect the existence of a link
between the author(s) of Cosmu and MiniDuke.
The most common compilation date seen for the loadersthat load the Cosmu malware is November 13 2012.
Perhaps coincidentally, we found one MiniDuke sample(originally reported by CrySys [3]) that also shows the same
compilation date. In this case however, the MiniDuke
component is actually a downloader; it connects to an
IP address in Turkey, and when it receives a response,
decrypts and executes it.
Also of interest is that once the MiniDuke loader was
updated, we saw CosmicDuke samples take the updated
loader into use in mid-April 1 2014, a few months after
MiniDuke started using the latest loader in mid-December
2013. It seems possible that the actors behind the two
malware families share code and/or tools.

FIGURE 4: MILESTONES IN PARALLEL LOADER USE*
IN COSMU AND MINIDUKE FAMILIES
Cosmu

2011

MiniDuke

Mar 24 20112012
Nov 13 2012

Nov 13 2012
Jun 18 2012

2013
2014

Dec 14 2013
Apr 18 2014

*Based on the compilation
timestamps of the loader

Original MiniDuke loader
Updated MiniDuke loader

1. Polish Institute of International Affairs; http://www.pism.pl/en
2. CIRCL - Computer Incident Response Center Luxembourg; Analysis of a stage 3 Miniduke sample; published 30 May 2013;
http://www.circl.lu/assets/files/tr-14/circl-analysisreport-miniduke-stage3-public.pdf
3. Laboratory of Cryptography and System Security (CrySyS Lab); MiniDuke: Indicators; published 27 February 2013;
http://www.crysys.hu/miniduke/miniduke_indicators_public.pdf

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

7

MAIN COMPONENT: INFO-STEALERPASSWORD STEALINGThe Cosmu info-stealer is the main component of theCosmicDuke malware. The technical description of theinfo-stealer is based on analysis of the following sample:

The malware targets the following software:

SHA1: b072577447cdf3936d95e612057e510dd3435963.

PERSISTENCE
Cosmu has a couple of different mechanisms for achieving
persistence on the system. It creates a scheduled task andinstalls a Windows service.
The scheduled task is typically named “Watchmon
Service”. It executes the malware at system startup.
The service typically has name javamtsup, and the display
name is ”Java(TM) Virtual Machine Support Service”. The
size of the service binary on disk varies, but typically thereal size is 5120 bytes (based on PE headers) and the SHA1
value is 7803f160af428bcfb4b9ea2aba07886f232cde4e.
The service itself is very straightforward: it opens a handle
to explorer.exe process, duplicates its process token,
reads the path of the actual malware binary from registry(key HKLM\Software\JavaSoft, value Supplement) andstarts the malware using the duplicated process token.
Cosmu copies itself with a couple of different filenames
to %WINDIR%\system32. The binaries on the disk have avariable length of zero-padding but they are all essentiallycopies of the original malware binary.
The filenames for both the Cosmu copies and the service
binary are generated by randomly taking two items fromthe following list and concatenating them, resulting infilenames like usbmon.exe, urllsa.exe, and rasdns.exe:
yy nt
yy infyy svcyy rasyy pptp
yy objyy netyy hostyy lsayy cmsyy dspyy sqlyy dhcp
yy srvyy dns
yy ip

yy fw
yy pc
yy ctfyy monyy pdbyy ms
yy cplyy sysyy ui
yy schd
yy tapiyy engyy cfgyy apiyy fs
yy urlyy envyy libyy udfyy wm
yy winyy id
yy wdmyy mgryy Instant messaging
 Skype
The malware steals Skype login MD5. The attacker
can obtain victim’s Skype username and password
by using a bruteforce or dictionary attack to crack
the MD5. The attack was publicly documented in2006 [4].
 Google Talk
Cosmu decrypts and steals saved credentials from
Google Talk.
 MSN Messenger
Cosmu decrypts and steals saved credentials fromMSN Messenger.
yy Browsers
 Google Chrome
Cosmu steals saved credentials from Google
Chrome.
 Internet Explorer
Cosmu steals autocomplete passwords from IE. It
also collects information about visited websites,
i.e., browsing history.
 Firefox
Cosmu steals saved credentials and the associatedURLs from Firefox. The malware does not decrypt
the credentials.
yy Email clients Thunderbird
Cosmu steals saved credentials and the associatedmail server hostnames from Thunderbird. The
malware does not decrypt the credentials.
 Bat email client
Cosmu steals credentials from Bat email clientby parsing account.cfn and decrypting thecredentials.
 Outlook Express
Cosmu steals saved credentials and information
about the associated mail server from Outlook
Express.
 Outlook
Cosmu steals saved credentials and information
about the associated mail server from Outlook.
 Google Desktop
Cosmu decrypts and steals saved credentials from
Google Desktop.

4. Fabrice Desclaux & Kostya Kortchinsky; Vanilla Skype part 2; published June 17th 2006;
http://www.recon.cx/en/f/vskype-part2.pdf

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

8

yy Others

KEY LOGGER

 Windows credentials
LM and NT hashes, cached domain passwords, LSA
secrets.

The keylogger is implemented using the
GetKeyboardState API. Key logging is skipped if one of thefollowing AV process is running on the system: WLAN
Cosmu uses WlanGetProfile to retrieve plain text
keys for WLANs.

yy avp.exe
yy acs.exe
yy outpost.exe
yy mcvsescn.exe
yy mcods.exe
yy navapsvc.exe
yy kav.exe
yy AvastSvc.exe
yy AvastUi.exe
yy nod32krn.exe
yy nod32.exe
yy ekern.exe
yy dwengine.exe
yy MsMpEng.exe
yy msseces.exe
yy ekrn.exe
yy savservice.exe
yy scfservice.exe
yy savadminservice.exe

CERTIFICATE STEALING
Cosmu exports certificates and, if available, theassociated private keys from system store by calling
PFXExportCertStoreEx. The malware uses the password“saribas” to encrypt the exported data.

TARGETED FILETYPES
Cosmu searches the hard drives and network drives forfiles that match any of the below patterns:
yy *.doc
yy *.xps
yy *.xls
yy *.ppt
yy *.pps
yy *.wps
yy *.wpd
yy *.ods
yy *.odt
yy *.lwp
yy *.jtdyy *.pdf
yy *.zipyy *.raryy *.docx
yy *.urlyy *.xlsx
yy *.pptx
yy *.ppsx
yy *.pst
yy *.ost
yy *psw*

yy *pass*
yy *login*yy *admin*yy *sifr*
yy *sifer*yy *vpnyy *.jpg
yy *.txt
yy *.lnk

SCREENSHOTTER
Cosmu takes screenshots periodically and sends them tothe attacker, together with other stolen data.

CLIPBOARD STEALER

Patterns *sifr* and *sifer* are interesting because theyclearly target non-English filenames, given that ‘sifr’ is the
Arabic word for zero (and interestingly enough, also thebase word for an encryption cipher in many languages).

Cosmu copies the content of the clipboard every 30
seconds and sends those to the attacker together withother stolen data.

Cosmu searches removable drives for a broader set of files– only files whose filename matches any of the following
patterns are skipped/ignored:

CONFIGURATION

yy *.exe
yy *.ndb
yy *.mp3
yy *.avi

yy HTTP server IPs and URL paths
yy FTP server IPs, usernames and passwords
yy WebDav IPs, usernames and passwords
yy Filename prefix and file extension for downloaded files
yy Filename prefix and file extension for exfiltrated data

An interesting detail is that Cosmu skips searching theremovable drive if the volume name is “trandescend”(case insensitive comparison).

In all the configurations we have seen, the servers are
specified using IP addresses, not domain names.

The configuration can contain the following information:

The configuration is embedded into the info-stealer. It iscompressed using an algorithm similar to but simpler than
LZNT-1 [5].

5. Microsoft Developer Network; 2.5 LZNT1 Algorithm Details;
http://msdn.microsoft.com/en-us/library/jj665697.aspx

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

9

NETWORK COMMUNICATIONSFIGURE 5: PYTHON IMPLEMENTATION OF THE
BUGGY RC4 ENCRYPTION

The sample makes HTTP GET requests to the server(s)specified in the configuration. The GET request contains
the following fields in this order:
yy m or mgn
yy Authyy Session
yy DataID
yy FamilyID
yy BranchID
yy VolumeIDyy Useryy Query.
The first field, m or mgn, does not have any value.
The value of Auth is the ID of the sample. It is the same
8-character hex digit that can be found in the PDB path,among other places.
The value of Query depends on the request. It is either
encoded using URL safe base64, or then the value isa 1792-character string. That string is composed of a
256-character string that is repeated seven times.
The 256-character string is generated by selecting
characters randomly from the following 32-characteralphabet:
abcdefghijklmnopqrstuvwxyz012345
The malware uses the FTP servers and WebDav servers
both for exfiltrating the collected data and for updating
the malware.
All servers used by the info-stealers listed in “Appendix A |Samples” are listed in “Appendix B | Servers”.

RC4 ENCRYPTION
Cosmu uses RC4 to decrypt incoming data and encryptoutgoing data. The RC4 routine is not standard RC4, butinstead of an intentional customization it seems that theimplementation is simply buggy. The mistake is illustrated
in Figure 5 that shows a Python re-implementation of the
buggy RC4.
All RC4 keys are 32 bytes. Here are the known keys:
yy pHG5AS4deKLil9ADdR2BcA1hTNm0FQz3
yy 3Pf4GxTaDnx50qWe2Xz62uSptFsR3g3P
yy AdjustKernelTableFromSSDTSpace2\x00
yy FB7V61C7509E4L99BDZ7F74A79A69CDF
Even though only the first 32 bytes are used as the RC4
key, the first two RC4 keys in the above list are followed byan interesting string:
Atruefriendissomeonewhothinksthatyouareagoodegg
eventhoughheknowsthatyouareslightlycrackedgroove“A true friend is someone who thinks that you are a goodegg even though he knows that you are slightly cracked”
is a Bernard Meltzer quote.

SAMPLES COMPARISON
A comparison of the compilation times of thesamples, and of other similarities observed in the filecharacteristics, reveals some interesting patterns. For
more details, see “Appendix A | Samples”.

LEGACY CREDENTIALS AND FTP FOLDER STRUCTURE
The oldest Cosmu samples we saw have a compilation
timestamp of 2001-09-25. Since it is possible for thecompilation timestamp to be manipulated, it may be thatthe samples are not that old. We have however not seen
any samples that would give us reason to suspect that thetimestamp has been tampered with.
These old samples do not use the MiniDuke loader andtherefore are not discussed in detail in this analysis. They
do however show some characteristics that link themto these fresh variants. For example, the credentials andsame FTP folder structure used by the old samples havebeen used on another Cosmu FTP server that is still active.

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

10
FIGURE 6: TIMELINE OF COMPILATION TIMESTAMPS & FILENAMESFOR COSMICDUKE’S DROPPERS, LOADERS & INFO-STEALERS

2014

Droppers

Loaders

May 28Apr 18

Info-stealers
16aa08ba5e1d27ac68b6ebf24d846bf6f2a204d1[Unknown]

fecdba1d903a51499a3953b4df1d850fbd5438bd

Apr 11
Mar 6
Mar 5
Mar 4
Mar 3
Feb 27Feb 7

ef3ce46a81d3f30fbcfbe5e0db18284329cc0d99
3e76dfa82161c64417e214b7607ad22ab40a8d69
c715e94dd187f3626f1b3e1511ae11525abf91e6
f513b21738ae3083d79e4fa1039889e1c3efff58
b072577447cdf3936d95e612057e510dd3435963
fb3b8f6494b211386381a7e4f6524d3e4643c9e9853679ae3172e448d676cbc9503f1474a5ca656f

2013
Sep 3
Aug 2

2c7c9ceeb61eac89e18b6e4ae0c855d982a0f232
rcs.Заказ.doc
0e5f55676e01d8e41d77cdc43489da8381b68086
rcs.Ukraine-Gas-PipelinesSecurity-Report-March-2014.pdf
5a199a75411047903b7ba7851bf705ec545f6da9
rcs.18.jpg
7631f1db92e61504596790057ce674ee90570755
rcs.DSC_1365527283.jpg
f621ec1b363e13dd60474fcfab374b8570ede4de

Jul 6

98f81b03a3b0f7b0b914d783683817953e8d4cf0

Jun 20620165967306d08d6a38dbd1381d84c71d62dea2

Jun 13

f9ba115b673be04ac09c9ee497ef03c5aa75429e

2012
Dec 4
Nov 13*.tmp

9700c8a41a929449cfba6567a648e9c5e*.tmp

4e3c9d7eb8302739e6931a3b5b605efe8f211e51
55f83ff166ab8978d6ce38e80fde858cf29e660b
6db1151eeb4339fc72d6d094e2d6c2572de89470
ed14da9b9075bd3281967033c90886fd7d4f14e5

Generated with an algorithm

580eca9e36dcd1a2deb9075bcae90afee46aace2
6a43ada6a3741892b56b0ef38cdf48df1ace236d
8aa9f5d426428ec360229f4cb9f722388f0e535c*.tmp or generated with an algorithm

5c5ec0b5112a74a95edc23ef093792eb3698320e

Sivil Durum Raporu Kriz Merkexe.yazi.pdf
ccb29875222527af4e58b9dd8994c3c7ef617fd8[Unknown]

b54b3c67f1827dab4cc2b3de94ff0af4e5db3d4c

Jul 27[Unknown]

764add69922342b8c4200d64652fbee1376adf1c

4fc6701a621f2a5ce3451c7969e4361bc3b836eb

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

11

FIGURE 7: INFO-STEALER GROUPS& C&C SERVERS USED PER GROUPNETHERLANDS

91.224.141.235

GROUP #1
RC4 KEY:LUXEMBOURG

94.242.199.88

RUSSIAFB7V61C7509E4L99
BDZ7F74A79A69CDF

178.170.164.84
212.76.128.149
195.43.94.104

DELIVERY:

3 DROPPERS, NO EXPLOITSGREECE

178.21.172.157

GROUP #3
RC4 KEYS:

PHG5AS4DEKLIL9ADD
R2BCA1HTNM0FQZ3PBD PATH CONTAINS:“BOTGENSTUDIO”

GROUP #2
RC4 KEY:

ADJUSTKERNELTABLEFROMSSDTSPACE2\X00

UNITED STATES

199.231.188.109

DELIVERY:?

CZECH REPUBLIC

176.74.216.14

DROPPERS, EXPLOITS

3PF4GXTADNX50QWE2XZ62USPTFSR3G3P

DELIVERY:ROMANIA

188.241.115.41

PBD PATH CONTAINS:“NITRO” AND “SVA”
SWEDEN

UNITED KINGDOM

95.154.228.106

PBD PATH CONTAINS:“KSK” (LATEST SAMPLES)

46.246.120.178
GERMANY

178.63.149.142

POLAND

LIVE IN JUNE 2014
DOWN IN JUNE 2014

188.116.32.164

COMPILATION TIMELINE

INFO-STEALER GROUPING

All droppers were compiled on 2013-08-02. The
majority of the loaders were compiled on 2012-1113, though one was compiled on 2012-12-04 - oddly
enough, the same day when one MiniDuke payload
reported by BitDefender [6] and Kaspersky [7], (md5:
6bc34809e44c40b61dd29e0a387ee682) was compiled.
This was a downloader that connects to an IP address inTurkey. As the server is no longer up however, we wereunable to investigate it further.

The info-stealer samples we have analyzed can be also
be separated into three distinct groupings based on thefollowing attributes:

The compilation timestamps of the info-stealers show
more variation. The oldest variant loaded with the
MiniDuke loader was compiled on 2012-12-04. Most of theinfo-stealers were compiled in February and March 2014.

yy The program database (PDB) pathyy Server address and credentials
yy The loader
yy Filenames and decoy content
Full list of the servers contacted by samples in thesegroupings in available in Appendix B | Servers on page 15.
Group #1
All samples in this group have a PDB path on theinfected system’s C:\ drive that contains the directory“botgenstudio”.

6. BitDefender; M. Tivadar, B. Balazs & C.Istrate; A Closer Look at MiniDuke;
http://labs.bitdefender.com/wp-content/uploads/downloads/2013/04/MiniDuke_Paper_Final.pdf
7. Securelist; C. Raiu, I. Soumenkov, K. Baumgartner & V. Kamluk; The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A
Micro Backdoor; https://www.securelist.com/en/downloads/vlpdfs/themysteryofthepdf0-dayassemblermicrobackdoor.pdf

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

12

yy c:\botgenstudio\generations\8f1777b0\bin\Bot.pdb
yy c:\botgenstudio\generations\fed14e50\bin\Bot.pdb
yy c:\botgenstudio\generations\55ff7700\bin\Bot.pdb
All samples in this group use the same RC4 key:
“FB7V61C7509E4L99BDZ7F74A79A69CDF”

Group #3
The most recent CosmicDuke samples all belong to thisgroup. Unlike Groups #1 and #2, no exploits or droppers
are known to be associated with Group #3 samples, andthe loader filenames do not use the RLO trick. As such, wewill not cover Group #3’s delivery method further.

The servers used by this group are exclusive to this group,i.e., the other sample groups do not use any of the servers
group #1 uses. The IP address of the servers used by thisgroup of samples are in Luxembourg, Netherlands, andRussia. See “Appendix B | Servers” for details.

Of more interest with Group #3 is that older samples
within this groupin show some differences from thelatest variants. A few older samples in Group #3 still use
the original MiniDuke loader, while most recent ones areusing the updated MiniDuke loader.

We have seen three different droppers for this sample
group. All droppers use the RLO trick.

Another difference is that unlike the older ones, the latest
samples use the following PDB path:

We have not found any exploits associated to this group of
samples.

yy D:\PRODUCTION\NITRO\KSK\Generations\70BCDEA1\
bin\Bot.pdb.

Group #2

This is quite similar to Group #2, though it seems “SVA” hasbeen replaced by “KSK”.

All samples in this group have a PDB path that contains
directories named “NITRO” and “SVA”. The PDB path isalways on D:\ drive. Here are some examples:

All samples in Group #3 connect to an FTP server at IP
188.116.32.164 using the same username (“adair”) andpassword. This is the only server that the samples with theoriginal MiniDuke loader use.

yy D:\production\nitro\sva\generations\809113dd\bin\Bot.pdbyy D:\SVA\NITRO\PRODUCTION\Generations\805B1D01\
bin\bot.pdb
yy D:\PRODUCTION\NITRO\SVA\Generations\8052B6C0\
bin\Bot.pdb
yy D:\PRODUCTION\NITRO\SVA\Generations\80B8A0BA\
bin\bot.pdb

Meanwhile, the most recent sample in Group #3,
which uses the updated loader with t the SHA1 value
fecdba1d903a51499a3953b4df1d850fbd5438bd, also
connects to another server at IP address 178.21.172.157.
The updated loader has PDB path, C:\Projects\NEMESIS\
nemesis-gemina\nemesis\bin\carriers\ezlzma_x86_exe.
pdb.

All samples except one in this group use PDF files with
exploits as an infection vector. The sole exception is
sha1:98f81b03a3b0f7b0b914d783683817953e8d4cf0. It
does not use an exploit and it does not use a dropper;
instead the loader has a filename (Sivil Durum Raporu Kriz
Merk?fdp.izay.exe) that uses the same RLO trick used inGroup #1 samples.
Another interesting detail for this sample is the PDB path:d:\sva\nitro\botgenstudio\interface\
generations\80ddfcc1\bin\Bot.pdb
Even though this contains both “SVA” and “NITRO”, it
also contains “botgenstudio”, again making it similar
to Group #1. One other sample in Group #2 (sha1:
fb3b8f6494b211386381a7e4f6524d3e4643c9e9) shows asimilar PDB path.
The servers used by this group are exclusive to this group,i.e., the other sample groups do not use any of the servers
group #2 uses.

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

13

APPENDIX A | SAMPLES
Exploit files
First seen

Filename

SHA1

Size

nota.pdf
dip.mail march.pdf
Bulletin-PISM-No-31-(625)-March-10-2014.pdf
March.pdf
paper_format.pdf

353540c6619f2bba2351babad736599811d3392e
5295b09592d5a651ca3f748f0e6401bd48fe7bda
c671786abd87d214a28d136b6bafd4e33ee66951
65681390d203871e9c21c68075dbf38944e782e8
8949c1d82dda5c2ead0a73b532c4b2e1fbb58a0e
74bc93107b1bbae2d98fca6d819c2f0bbe8c9f8a

946124917093919914917093908285917093(YYYY-MM-DD)

2013-11-04
2014-03-20
2014-03-14
2014-03-11
2014-03-05
2013-07-01

				Droppers		
First seen

Filename

SHA1(YYYY-MM-DD)

Compiled

Size(All times in UTC)

2014-04-27
2014-03-18
2014-03-13

rcs.DSC_1365527283.jpg
rcs.18.jpg
rcs.Ukraine-Gas-PipelinesSecurity-ReportMarch-2014.pdf

f621ec1b363e13dd60474fcfab374b8570ede4de
7631f1db92e61504596790057ce674ee90570755
5a199a75411047903b7ba7851bf705ec545f6da9

Fri Aug 2 10:50:12 2013
Fri Aug 2 10:50:12 2013
Fri Aug 2 10:50:12 2013

4300808110089420802013-11-11

rcs.Заказ.doc

0e5f55676e01d8e41d77cdc43489da8381b68086 Fri Aug 2 10:50:12 2013

405504Filename

SHA1

Size

Loaders
First seen(YYYY-MM-DD)

2013-11-04
2014-06-03
2014-05-26
2014-05-23
2014-04-27

Compiled(All times in UTC)*.tmp
Unknown
Unknown
Unknown
Generated by the dropper*.tmp or generated by the
dropper*.tmp
Generated by the dropper

9700c8a41a929449cfba6567a648e9c5e4a14e70
fecdba1d903a51499a3953b4df1d850fbd5438bd
b54b3c67f1827dab4cc2b3de94ff0af4e5db3d4c764add69922342b8c4200d64652fbee1376adf1c
6a43ada6a3741892b56b0ef38cdf48df1ace236d
5c5ec0b5112a74a95edc23ef093792eb3698320e

Tue Dec 4 14:25:19 2012
Fri Apr 18 06:53:42 2014
Tue Nov 13 09:52:51 2012
Fri Jul 27 11:37:20 2012
Tue Nov 13 09:53:11 2012
Tue Nov 13 09:51:48 2012

86272073830479206450483269785673216055f83ff166ab8978d6ce38e80fde858cf29e660b
8aa9f5d426428ec360229f4cb9f722388f0e535c

Tue Nov 13 09:53:11 2012
Tue Nov 13 09:53:11 2012

6978566978566db1151eeb4339fc72d6d094e2d6c2572de89470
ed14da9b9075bd3281967033c90886fd7d4f14e5
ccb29875222527af4e58b9dd8994c3c7ef617fd8

Tue Nov 13 09:52:51 2012 744960
Tue Nov 13 09:53:11 2012 697856
Tue Nov 13 09:53:11 2012 697856

2013-11-14

*.tmp
*.tmp
Sivil Durum Raporu Kriz
Merkexe.yazi.pdf
Generated by the dropper

580eca9e36dcd1a2deb9075bcae90afee46aace2

Tue Nov 13 09:53:11 2012

6978562013-07-16*.tmp

4e3c9d7eb8302739e6931a3b5b605efe8f211e51

Tue Nov 13 09:53:11 2012

697856

2014-03-26
2014-03-20
2014-03-18
2014-03-14
2014-03-05
2013-07-22

COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

14

APPENDIX A | SAMPLES (CON’D)
Info-stealers
The filenames for all Info-stealer samples are all generated at runtime (see the Persistence section on page 7).

First seen

SHA1(YYYY-MM-DD)

2013-11-04
2014-06-03
2014-05-26
2014-05-23
2014-04-27
2014-03-20
2014-03-18
2014-03-14
2014-03-11
2014-03-05
2013-11-11
2013-07-22
2013-07-01

Compiled

Size(All times in UTC)

4fc6701a621f2a5ce3451c7969e4361bc3b836eb
16aa08ba5e1d27ac68b6ebf24d846bf6f2a204d1
853679ae3172e448d676cbc9503f1474a5ca656f
f9ba115b673be04ac09c9ee497ef03c5aa75429e
ef3ce46a81d3f30fbcfbe5e0db18284329cc0d99
fb3b8f6494b211386381a7e4f6524d3e4643c9e9b072577447cdf3936d95e612057e510dd3435963
3e76dfa82161c64417e214b7607ad22ab40a8d69
f513b21738ae3083d79e4fa1039889e1c3efff58
c715e94dd187f3626f1b3e1511ae11525abf91e6
2c7c9ceeb61eac89e18b6e4ae0c855d982a0f232
98f81b03a3b0f7b0b914d783683817953e8d4cf0620165967306d08d6a38dbd1381d84c71d62dea2

Tue Dec 4 14:13:53 2012
Wed May 28 14:40:02 2014
Fri Feb 7 10:02:26 2014
Thu Jun 13 14:29:06 2013
Fri Apr 11 09:38:43 2014
Thu Feb 27 07:40:23 2014
Mon Mar 3 13:07:34 2014
Thu Mar 6 13:14:26 2014
Tue Mar 4 14:37:15 2014
Wed Mar 5 10:30:04 2014
Tue Sep 3 13:13:56 2013
Sat Jul 6 14:46:59 2013
Thu Jun 20 10:09:59 2013

352256129024124416122880212992
178688208896
188416173568183808172032176128388608COSMICDUKE COSMU WITH A TWIST OF MINIDUKE

15

APPENDIX B | SERVERSIP Address
178.21.172.157
188.116.32.164
176.74.216.14
178.63.149.142
188.241.115.41
195.43.94.104
95.154.228.106
199.231.188.109
46.246.120.178
94.242.199.88
178.170.164.84
212.76.128.149
91.224.141.235

Sample Group
3
3
2
2
2
2
2
2
2
1
1
1
1

Country
GreecePolandCzech Republic
Germany
Romania
RussiaUnited Kingdom
United States
SwedenLuxembourg
RussiaRussiaNetherlands

ProtocolFTP, HTTP
FTP, HTTP
FTP, HTTP
FTP, HTTP, WebDav
FTP, HTTP, WebDav
FTP, HTTP
FTP, HTTP
FTP, HTTP
FTP, HTTP
FTP, HTTP
FTP, HTTP
FTP, HTTP
FTP, HTTP

Live in June 2014?
Yes
Yes
Yes
Yes
No
Connection refused
Yes
Yes
Yes
Yes
Yes
Yes
Yes

For more information, please contact:viruslab@f-secure.com
For an electronic version of this document, please go to:
http://www.f-secure.com/en/web/labs_global/whitepapers/technical