Eric.freyssinet: Text replacement - " securelist.com" to ""

2015-02-08T16:48:20Z

Text replacement - " securelist.com" to ""

← Older revision		Revision as of 16:48, 8 February 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duqu_Framework ~~securelist.com~~		\|Link=http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duqu_Framework
	\|Author=Igor Soumenkov,		\|Author=Igor Soumenkov,
	\|NomRevue=Securelist		\|NomRevue=Securelist

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:38Z

1 revision imported

← Older revision		Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

2014-08-27T16:31:41Z

Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

New page

{{Publication
|Image=The_mystery_of_the_Duqu_framework.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.securelist.com/en/blog/667/The_Mystery_of_the_Duqu_Framework securelist.com
|Author=Igor Soumenkov,
|NomRevue=Securelist
|Date=March 07 2012
|Editor=Kaspersky lab
|Year=2012
|ISBN=
|Page=
|Abstract=While analyzing the components of Duqu, we discovered an interesting anomaly in the main component that is responsible for its business logics, the Payload DLL. We would like to share our findings and ask for help identifying the code.

Code layout

At first glance, the Payload DLL looks like a regular Windows PE DLL file compiled with Microsoft Visual Studio 2008 (linker version 9.0). The entry point code is absolutely standard, and there is one function exported by ordinal number 1 that also looks like MSVC++. This function is called from the PNF DLL and it is actually the “main” function that implements all the logics of contacting C&C servers, receiving additional payload modules and executing them. The most interesting is how this logic was programmed and what tools were used.

The code section of the Payload DLL is common for a binary that was made from several pieces of code. It consists of “slices” of code that may have been initially compiled in separate object files before they were linked in a single DLL. Most of them can be found in any C++ program, like the Standard Template Library (STL) functions, run-time library functions and user-written code, except the biggest slice that contains most of C&C interaction code.
|Botnet=Duqu,
|Malware=Duqu_(bot),
|CCProtocol=,
|Operation=,
|Keyword=,
}}

The mystery of the Duqu framework - Revision history

Eric.freyssinet: Text replacement - " securelist.com" to ""

Eric.freyssinet: 1 revision imported

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »

Eric.freyssinet: Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »