Anti-Malware Research

Early Version of MiniDuke Ran on Chinese Time

Bitdefender antimalware researchers have come across samples of a previously-unrecognized version of the MiniDuke virus which, as it turns out, was active as early as May 2012 – and it wants to know what time it is in China.

A new sample of the ~20KB MiniDuke backdoor shows (in its header) a compile time of  21st of May 2012.

Previously known variants show a compile time of 20th of February, 2013.The sample was first detected and added to the Bitdefender malware database on 26th of May 2012. In conclusion, the file can be confidently dated to May 2012 or earlier.

The 2012 sample uses a different installation mode – it is hosted in an executable file as an embedded .dll.

The .dll is packed with the same packer as later variants and the code itself is similar. The .exe file drops the .dll, under the name of tempfile.dat and loads it using rundll32. exe

Then the virus adds itself to the registry under the key

Software\Microsoft\Windows NT\CurrentVersion\Winlogon, shell entry:

Unlike the February 2013 samples, it sets an environment variable which contains the path towards the malware. The path where it is stored is identical to the other variants: C:\Documents and Settings\All Users\ and possibly one of the “Application Data” or “Microsoft” subdirectories (picked at random).

The environment variable name can be one of the values :


The .dll copied in the temp path has one of the names: ntuser.dat, registry.dat, index.db, profile.dat, sysdata.dat, config.dat, sysini.dat, bootstat.dat … (see above). By contrast, samples from 2013 concatenate several string chunks, picking from:

“base, user, reg, index, profile, system, data, config, init, boot, stat, cache, class, setup, network.. etc”

and gets run using a .lnk file added to Startup.

A very interesting detail:

the virus accesses which returns the current time and date in China! If an Internet connection is not present, the system time is used (connection is retried twice every 10 minutes.Although it requests date and time values for China, the malware seems to use only the date(y/m/d), not the time of day.

The time user agent for contacting Google is:

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

while other variants used different user agents.

Analysis is ongoing but so far it appears that otherwise this sample behaves the same as later ones.

The payload files which are downloaded (.gif) are decrypted and saved under one of the names:

winupdt.exe wcsntfy.exe netmngr.exe dumpreport.exe taskhosts.exe wupdmngr.exe winhlp.exe dllhosts.exe dxdiagupd.exe dialers.exe netschd.exe connwiz.exe certupdt.exe repfault.exe wuapreport.exe lanmgr.exe

and is then run with WinExec() if it is an .exe or loaded using LoadLibrary() if it’s a .dll.

Bitdefender antivirus software detects and removes all known variants of MiniDuke. A free stand-alone removal tool is available: MiniDuke Removal Tool (6139 downloads) .

About the author


Razvan Stoica is a journalist turned teacher turned publicist and technology evangelist. When Bitdefender isn't paying him to bring complex subjects to wide audiences, he enjoys writing fiction, skiing and biking. Razvan Stoica started off writing for a science monthly and was the chief editor of a science fiction magazine for a short while before moving on to the University of Medicine in Bucharest where he lectured on the English language. Recruited by Bitdefender in 2004 to add zest to the company's online presence, he has fulfilled a bevy of roles within the company since. In his current position, he is primarily responsible for the communications and community-building efforts of the Bitdefender research and technology development arm.


Click here to post a comment