Difference between revisions of "DuQu (malware)"
Jump to navigation
Jump to search
DavidB4-bot (talk | contribs) (Spelling/Grammar Check & Cleanup) |
m (wikilink) |
||
| Line 1: | Line 1: | ||
| − | '''DuQu''' is [[computer]] [[malware]] classified as a Trojan Horse. It is built with the same basic source code of [[Stuxnet]], so it has been concluded that this malware was designed and released by the same party responsible for Stuxnet. Some are even referring to DuQu as Stuxnet 2.0.<ref>http://www.pcworld.com/article/242114/duqu_new_malware_is_stuxnet_2.html</ref> In general, this Trojan Horse was designed for intelligence gathering and espionage.<ref>http://www.kaspersky.com/about/press/major_malware_outbreaks/duqu</ref> There have been two versions of this malware released so far—the latter was detected in June 2015.<ref>http://www.kaspersky.com/about/news/virus/2015/Duqu-is-back</ref> | + | '''DuQu''' is [[computer]] [[malware]] classified as a Trojan Horse. It is built with the same basic source code of [[Stuxnet]], so it has been concluded that this malware was designed and released by the same party responsible for Stuxnet. Some are even referring to DuQu as Stuxnet 2.0.<ref>http://www.pcworld.com/article/242114/duqu_new_malware_is_stuxnet_2.html</ref> In general, this [[Trojan Horse (malware)|Trojan Horse]] was designed for intelligence gathering and espionage.<ref>http://www.kaspersky.com/about/press/major_malware_outbreaks/duqu</ref> There have been two versions of this malware released so far—the latter was detected in June 2015.<ref>http://www.kaspersky.com/about/news/virus/2015/Duqu-is-back</ref> |
==Technical Specifics== | ==Technical Specifics== | ||
| − | Duqu is often delivered as a [[Microsoft]] [[Word]] document. Once opened, it exploits what was at the time of release a | + | Duqu is often delivered as a [[Microsoft]] [[Word]] document. Once opened, it exploits what was at the time of release a [[Zero-day (computing)|zero-day vulnerability]] (that is, one which was completely unknown) in font handling. Once a computer is infected, it opens a "back door" and begins downloading the main content of the malware. It also has rootkit functionality, so it can run nearly invisibly on the host computer.<ref>https://www.symantec.com/security_response/writeup.jsp?docid=2011-101814-1119-99</ref><ref>https://securelist.com/blog/incidents/32463/duqu-faq-33</ref> |
===Vulnerable [[Operating system|Operating System]]s=== | ===Vulnerable [[Operating system|Operating System]]s=== | ||
*Windows NT | *Windows NT | ||
Latest revision as of 04:15, July 25, 2017
DuQu is computer malware classified as a Trojan Horse. It is built with the same basic source code of Stuxnet, so it has been concluded that this malware was designed and released by the same party responsible for Stuxnet. Some are even referring to DuQu as Stuxnet 2.0.[1] In general, this Trojan Horse was designed for intelligence gathering and espionage.[2] There have been two versions of this malware released so far—the latter was detected in June 2015.[3]
Technical Specifics
Duqu is often delivered as a Microsoft Word document. Once opened, it exploits what was at the time of release a zero-day vulnerability (that is, one which was completely unknown) in font handling. Once a computer is infected, it opens a "back door" and begins downloading the main content of the malware. It also has rootkit functionality, so it can run nearly invisibly on the host computer.[4][5]
Vulnerable Operating Systems
- Windows NT
- Windows 95
- Windows 98
- Windows 2000
- Windows Me
- Windows Server 2003
- Windows XP
- Windows Server 2008
- Windows Vista
- Windows 7[6]
References
- ↑ http://www.pcworld.com/article/242114/duqu_new_malware_is_stuxnet_2.html
- ↑ http://www.kaspersky.com/about/press/major_malware_outbreaks/duqu
- ↑ http://www.kaspersky.com/about/news/virus/2015/Duqu-is-back
- ↑ https://www.symantec.com/security_response/writeup.jsp?docid=2011-101814-1119-99
- ↑ https://securelist.com/blog/incidents/32463/duqu-faq-33
- ↑ https://www.symantec.com/security_response/writeup.jsp?docid=2011-101814-1119-99