Deep track Duqu Trojan

At present, the well-known information security manufacturers Kaspersky Laboratory security experts are still on the Duqu Trojan tireless investigation, and found more details about the Trojan and its complex working principles, including the use of the Trojan horse transmission and infection means. There are even some interesting points to be found, of course, in the malware problem, not as a funny thing.

The survey found that the Duqu Trojan's intrusion method uses a carefully crafted social engineering email. These emails contain a vulnerable. doc file and Trojan installer, in addition to a cunning delay-executing vulnerability using the program downloader. This kind of mail is in fact as early as April 2011 has appeared.

The vulnerability utility in the. doc file is an embedded font named Dexter Regular. This name allows the recipient to assume that he or she has registered Showtime Inc., a TV channel that plays TV show "Dexter". The TV show is a story of a CSI agent who is also a serial killer.

In addition, the latest research also found that each case of the Duqu Trojan is unique, and before the attack will be tailored to specific targets. Each attack also uses a different command to control the server.

The latest findings suggest that Kaspersky Labs has found at least 12 different Duqu files. Since the investigation is still in progress, it is not possible to publish all of the findings. After that, Kaspersky will reveal more details about the Trojan.