Skip to main content

DUQU - The RAT



                Duqu is a remote access Trojan (RAT) that contain multiple malicious files which can attacks computers, as a word document. It attacks industrial control equipment manufacturers (gas, electric and water) and collects all intelligence information in the compromised computer (ex: user credential, manufacturing details) illegally. 



It uses kernel drivers to decrypt and loads encrypted dynamic link library (DLL). These kernel drives act as an injection engine to load DLL. The encrypted files are stored as a .pnf file in the kernel, which is normally set up information file extension in Microsoft Windows system. Since it is remote access Trojan, it will allow the machine to download and run additional programs.


Duqu is looking like somewhat Stuxnet worm. Its kernel drives have a digitally signed certificate same as Stuxnet. Consequently, all data can be stole and computer is remotely operated by an attacker without user knowledge. Even though numerous characteristic of Duqu same as Stuxnet, but it cannot replicate by itself




"For every lock, there is someone out there trying to pick it or break in" -  David Bernsteing

.

Comments

Post a Comment

Popular posts from this blog

Change Language in Google Account

When we create an email address, sometimes we do not consider the language preferences. Afterward, when we log in to a google account, context will be shown as unfamiliar. So we can change the language preferences of google account by following steps.  1.  Click on the Google profile and select google account 2.  Select data & personalization settings. 3. Scroll down and go to general preferences for the web. And click language. 4. If you need to change the default language, click on the pen sign. 5. If you want to add more languages, click on add other languages.
Post a Comment
Read more

Phishing - Hook for your data

Phishing is a trap to get your sensitive data through email which seems, it is from a trusted and well-known sender. This fraudulent attempt is done by online scammers (cybercriminal) to steal your identity and passwords to do crimes. The term “Phishing” was first used in 1996 that occurred in Usenet newsgroup called AOHell. Since the earlier hackers are called “Phreaks”, the ‘f’ in fishing replaced by ‘ph’. Even phishing attacks start to propagate through email, now it held by phone calls too. Mostly the attackers target a certain group or individual, Instead of sending emails to a large number of people. And those email seems like it is from reputed organization. Phishing emails make recipient panic by saying that your account has been hacked or there is an unrecognized activity occurred in your account and forced them to change their credentials using a given link. On the other hand, victims encourage to click on the link by saying that they have won a reward . When the receiv...
2 comments
Read more

Install Chrome in Kali Linux

Chrome is the most convenient search engine with multiple application. And it is compatible for customizable extension too. Therefore chrome is preferred as default browser by everyone. Hence here the few steps to install chrome in your Kali Linux machine. Open Terminal, first of all, repositories should be updated.   1.  sudo apt-get update Then download chrome .deb package. you can install it from your browser too. Here .deb package is installed using terminal commands.    2. wget  https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb   Run installed .deb file in order to install the chrome browser.     3. sudo  dpkg  -i  google-chrome-stable_current_amd64.deb  After installing the chrome into your kali machine now you can use it as your default browser.
Post a Comment
Read more