The Duqu trojan main purpose is to obtain a remote access allowing an adversary to gather information from a compromised computer and of course to download and run arbitrary programs. Duqu malware spotted and identified by experts is based on the same Stuxnet code, however unlike Stuxnet, Duqu does not contain specific code related industrial control systems.
The excellent group CrySyS has located an installer for the malware threat; the installer file is a Microsoft Word document (.doc) that exploits a previously unknown kernel vulnerability that allows code execution. Opening the file a malicious code is able to executes Duqu binaries code.
From Symantec Corp. an interesting article related the malware and the exploit procedure found.
From SecureWorks Counter Threat Unit Research Team more info regarding the threat and its features.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.