SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tdiscoverer (Back to overview)

tDiscoverer

aka: HAMMERTOSS, HammerDuke

Actor(s): APT29


F-Secure described tDiscoverer (also known as HammerDuke) as interesting because it is written in .NET, and even more so because of its occasional use of Twitter as a C&C communication channel. Some HammerDuke variants only contain a hardcoded C&C server address from which they will retrieve commands, but other HammerDuke variants will first use a custom algorithm to generate a Twitter account name based on the current date. If the account exists, HammerDuke will then search for tweets from that account with links to image files that contain embedded commands for the toolset to execute.

References
2015-09-28SecurityIntelligenceDavid Strom
@online{strom:20150928:hammertoss:b643bfe, author = {David Strom}, title = {{Hammertoss: What, Me Worry?}}, date = {2015-09-28}, organization = {SecurityIntelligence}, url = {https://securityintelligence.com/hammertoss-what-me-worry/}, language = {English}, urldate = {2021-02-10} } Hammertoss: What, Me Worry?
tDiscoverer
2015-07-29Youtube (FireEye Inc.)FireEye
@online{fireeye:20150729:hammertoss:96456d6, author = {FireEye}, title = {{HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group}}, date = {2015-07-29}, organization = {Youtube (FireEye Inc.)}, url = {https://www.youtube.com/watch?v=UE9suwyuic8}, language = {English}, urldate = {2021-02-10} } HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group
tDiscoverer
2015-07FireEyeFireEye Threat Intelligence
@techreport{intelligence:201507:hammertoss:9275999, author = {FireEye Threat Intelligence}, title = {{HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group}}, date = {2015-07}, institution = {FireEye}, url = {https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf}, language = {English}, urldate = {2019-10-23} } HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group
tDiscoverer APT29

There is no Yara-Signature yet.