The mystery of Duqu: part one - Revision history

Eric.freyssinet at 03:04, 19 August 2015

2015-08-19T03:04:06Z

← Older revision		Revision as of 03:04, 19 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Image~~=		\|Botnet=Duqu, Stuxnet,
	\|~~Legend~~=		\|Malware=Duqu (bot),
	\|~~Document~~=		\|CCProtocol=,
	\|~~Licence~~=		\|Operation=,
	\|~~Video~~=		\|Year=2011
			\|Date=2011-10-20
			\|Editor=Kaspersky lab
	\|Link=http://www.securelist.com/en/blog/208193182/The_Mystery_of_Duqu_Part_One		\|Link=http://www.securelist.com/en/blog/208193182/The_Mystery_of_Duqu_Part_One
	\|Author=Alexander Gostev,		\|Author=Alexander Gostev,
	~~\|NomRevue=Securelist~~
	~~\|Date=20 octobre 2011~~
	~~\|Editor=Kaspersky lab~~
	~~\|Year=2011~~
	~~\|ISBN=~~
	~~\|Page=~~
	\|Abstract=First of all, we feel it necessary to clarify some of the confusion surrounding the files and their names related to this incident. To get a full understanding of the situation you only need to know that we’re talking about just two malicious programs here (at a minimum) - the main module and a keylogger. All that has been mentioned in last 24 hours about connections between Duqu and Stuxnet is related mostly to the first one - the main module.<br>		\|Abstract=First of all, we feel it necessary to clarify some of the confusion surrounding the files and their names related to this incident. To get a full understanding of the situation you only need to know that we’re talking about just two malicious programs here (at a minimum) - the main module and a keylogger. All that has been mentioned in last 24 hours about connections between Duqu and Stuxnet is related mostly to the first one - the main module.<br>

Line 21:		Line 17:

	The module is very similar to Stuxnet - both in structure and in behavior. However, the name Duqu has almost no connection with it. This name is based on the names of the files that are related to a completely different malicious spy-program!		The module is very similar to Stuxnet - both in structure and in behavior. However, the name Duqu has almost no connection with it. This name is based on the names of the files that are related to a completely different malicious spy-program!
	\|~~Botnet~~=~~Duqu, Stuxnet,~~		\|Document=
	\|~~Malware~~=~~Duqu (bot),~~		\|Licence=
	\|~~CCProtocol~~=,		\|Video=
	\|~~Operation~~=,		\|NomRevue=Securelist
	\|Keyword=Rootkits, Targeted Attacks, Keyloggers, Industrial control systems, Certificate authorities,		\|ISBN=
			\|Page=
			\|Keyword=Rootkits, Targeted Attacks, Keyloggers, Industrial control systems, Certificate authorities,
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:44Z

1 revision imported

← Older revision	Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky lab Lab » par « |Editor=Kaspersky lab »

2014-08-27T19:14:14Z

Remplacement de texte — « |Editor=Kaspersky lab Lab » par « |Editor=Kaspersky lab »

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.securelist.com/en/blog/208193182/The_Mystery_of_Duqu_Part_One
|Author=Alexander Gostev,
|NomRevue=Securelist
|Date=20 octobre 2011
|Editor=Kaspersky lab
|Year=2011
|ISBN=
|Page=
|Abstract=First of all, we feel it necessary to clarify some of the confusion surrounding the files and their names related to this incident. To get a full understanding of the situation you only need to know that we’re talking about just two malicious programs here (at a minimum) - the main module and a keylogger. All that has been mentioned in last 24 hours about connections between Duqu and Stuxnet is related mostly to the first one - the main module.<br>

The main module consists of three components:
* a driver that injects a DLL into system processes;
* a DLL that has an additional module and works with the C&C; and
* a configuration file.

The module is very similar to Stuxnet - both in structure and in behavior. However, the name Duqu has almost no connection with it. This name is based on the names of the files that are related to a completely different malicious spy-program!
|Botnet=Duqu, Stuxnet,
|Malware=Duqu (bot),
|CCProtocol=,
|Operation=,
|Keyword=Rootkits, Targeted Attacks, Keyloggers, Industrial control systems, Certificate authorities,
}}

The mystery of Duqu: part one - Revision history

Eric.freyssinet at 03:04, 19 August 2015

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky lab Lab » par « |Editor=Kaspersky lab »

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky lab Lab » par « |Editor=Kaspersky lab »