Bitdefender antimalware researchers have come across samples of a previously-unrecognized version of the MiniDuke virus which, as it turns out, was active as early as May 2012 – and it wants to know what time it is in China.
Previously known variants show a compile time of 20th of February, 2013.The sample was first detected and added to the Bitdefender malware database on 26th of May 2012. In conclusion, the file can be confidently dated to May 2012 or earlier.
Software\Microsoft\Windows NT\CurrentVersion\Winlogon, shell entry:
Unlike the February 2013 samples, it sets an environment variable which contains the path towards the malware. The path where it is stored is identical to the other variants: C:\Documents and Settings\All Users\ and possibly one of the “Application Data” or “Microsoft” subdirectories (picked at random).
The environment variable name can be one of the values :
The .dll copied in the temp path has one of the names: ntuser.dat, registry.dat, index.db, profile.dat, sysdata.dat, config.dat, sysini.dat, bootstat.dat … (see above). By contrast, samples from 2013 concatenate several string chunks, picking from:
“base, user, reg, index, profile, system, data, config, init, boot, stat, cache, class, setup, network.. etc”
and gets run using a .lnk file added to Startup.
the virus accesses http://www.time-server.org/get_time.php?country=China which returns the current time and date in China! If an Internet connection is not present, the system time is used (connection is retried twice every 10 minutes.Although it requests date and time values for China, the malware seems to use only the date(y/m/d), not the time of day.
The time user agent for contacting Google is:
“User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)”
while other variants used different user agents.
Analysis is ongoing but so far it appears that otherwise this sample behaves the same as later ones.
The payload files which are downloaded (.gif) are decrypted and saved under one of the names:
“winupdt.exe wcsntfy.exe netmngr.exe dumpreport.exe taskhosts.exe wupdmngr.exe winhlp.exe dllhosts.exe dxdiagupd.exe dialers.exe netschd.exe connwiz.exe certupdt.exe repfault.exe wuapreport.exe lanmgr.exe”
and is then run with WinExec() if it is an .exe or loaded using LoadLibrary() if it’s a .dll.
Bitdefender antivirus software detects and removes all known variants of MiniDuke. A free stand-alone removal tool is available: MiniDuke Removal Tool (5443 downloads) .