Unknown Programming Language in the Duqu Trojan

Ocky · Mar 8, 2012

Unknown Programming Language in the Duqu Trojan

The big unsolved mystery of the Duqu Trojan relates to how the malicious program was communicating with its Command and Control (C&C) servers once it infected a victim’s machine. The Duqu module that was responsible for interacting with the C&Cs is part of its Payload DLL. After a comprehensive analysis of the Payload DLL, Kaspersky Lab researchers have discovered that a specific section inside the Payload DLL, which communicates exclusively with the C&Cs, was written in an unknown programming language. Kaspersky Lab researchers have named this unknown section the “Duqu Framework.”
Click to expand...

vasa1 · Mar 8, 2012

Here's something from the html source code of a FAQ for a very popular extension to a very popular browser:
Code:
<x0_7ko5zfamjjk></x0_7ko5zfamjjk><x1_o4sjrmwww8k></x1_o4sjrmwww8k><x2_j1v427whkrw></x2_j1v427whkrw><x3_68ztmqm2fxs></x3_68ztmqm2fxs><x4_6nwio5j73lc></x4_6nwio5j73lc><x5_15n40hc42bk></x5_15n40hc42bk><x6_e24pg0wdotc></x6_e24pg0wdotc>

acr1965 · Mar 10, 2012

Kaspersky : Duqu Trojan contains mystery programming language in Payload DLL

http://www.techspot.com/news/47739-...tery-programming-language-in-payload-dll.html

Experts at Russian computer security company Kaspersky have come to the conclusion that parts of the Duqu Trojan are written in an unknown programming language. Much of the code is identified as standard C++ but the team is clueless as to the origin of other segments and is asking the programming community for assistance.
Click to expand...

siljaline · Mar 10, 2012

Some interesting information also spotted here, here, here

Dermot7 · Mar 19, 2012

In my previous blogpost about the Duqu Framework, I described one of the biggest remaining mysteries about Duqu – the oddities of the C&C communications module which appears to have been written in a different language than the rest of the Duqu code. As technical experts, we found this question very interesting and puzzling and we wanted to share it with the community.
Click to expand...

https://www.securelist.com/en/blog/677/The_mystery_of_Duqu_Framework_solved

AlexC · Mar 22, 2012

Mystery of Duqu Programming Language Solved

http://developers.slashdot.org/story/12/03/19/1458206/mystery-of-duqu-programming-language-solved

"Earlier this month, researchers from Kaspersky Lab reached out to the security and programming community in an effort to help solve a mystery related to 'Duqu,' the Trojan often referred to as 'Son of Stuxnet,' which surfaced in October 2010. The mystery rested in a section of code written an unknown programming language and used in the Duqu Framework, a portion of the Payload DLL used by the Trojan to interact with Command & Control (C&C) servers after the malware infected system. Less than two weeks later, Kaspersky Lab experts now say with a high degree of certainty that the Duqu framework was written using a custom object-oriented extension to C, generally called 'OO C' and compiled with Microsoft Visual Studio Compiler 2008 (MSVC 200 with special options for optimizing code size and inline expansion."
Click to expand...

Log in or Sign up

Unknown Programming Language in the Duqu Trojan

Ocky Registered Member

vasa1 Registered Member

acr1965 Registered Member

siljaline Registered Member

Dermot7 Registered Member

AlexC Registered Member

Log in or Sign up

Unknown Programming Language in the Duqu Trojan

Ocky Registered Member

vasa1 Registered Member

acr1965 Registered Member

siljaline Registered Member

Dermot7 Registered Member

AlexC Registered Member

Useful Searches