That MYSTERY Duqu Trojan language: Plain old C

How quaint


An appeal for help from the programming community has allowed antivirus analysts to classify the unknown language used to develop key components of the Duqu Trojan.

Duqu creates a backdoor on compromised SCADA-based industrial control systems. The malware is closely related to the nuke plant centrifuge-busting Stuxnet worm and was probably developed by the same group. Security researchers at Kaspersky Lab found that Duqu uses the mystery code to communicate with its command-and-control (C&C) servers from infected machines. Unlike the rest of Duqu, the so-called Duqu Framework is not written in C++ and it's not compiled with Microsoft's Visual C++ 2008.

The code was not written using Delphi or .Net, other virus-writing favourites, either. Hardcore VXers use assembler to write malicious code but it wasn't that either.

After going some way in unraveling the mystery language used by the Duqu Framework, Kaspersky Lab researchers appealed for help from the programming community.

During a webcast on Monday, Kaspersky Lab chief malware expert Vitaly Kamluk said that a variety of programming languages had been suggested in response for this appeal for help, including Lisp and Ada.

However the suggestion that the Duqu Framework might have been developed using old-school Object Oriented C (OO C) hit the bullseye. Code compiled using C and Microsoft Visual Studio 2008 was a close match for the code in the Duqu framework, allowing Kaspersky researchers to conclude that the framework had been written using a custom object-oriented extension to C or plain C with a changed dialect, as Kamluk described it.

"It's old school C. These are techniques used by professional software developers but not malware writers," Kamluk explained.

Kamluk said the whoever created the framework had reapplied an approach most often encountered in professional Mac OS applications development to create Windows malware.

Using the approach offered several advantages compared to using conventional malware writing techniques, Kamluk explained. He said that the approach created code that was "more efficient, smaller, faster, more flexible and re-useable".

Knowing the techniques used to develop the malware allows Kaspersky's researchers to make better guesses about who might be behind the code. The security researchers said that the Duqu framework was probably created by old school professional developers who were well used to making software using Object Oriented C.

"The developers of the framework prefer to extend an 'old-school' language with contemporary techniques," the Kaspersky boffins conclude. "The framework could have been reused from an existing software project. [The approach is] common for professional software developers, but unique for malware writers."

"The code was written by a team of experienced ‘old-school’ developers who wanted to create a customised framework to support a highly flexible and adaptable attack platform. The code could have been reused from previous cyber-operations and customised to integrate into the Duqu Trojan,” said Igor Soumenkov, Kaspersky Lab malware expert. “However, one thing is certain: these techniques are normally seen by elite software developers and almost never in today’s general malware.”

Creating Duqu was a major project, so it’s possible that an entirely different team was responsible for creating the Duqu Framework, while others worked on creating drivers and system infection exploits. In this scenario it's even possible that those who created the Duqu framework were ignorant of the real purpose of their work.

Compiling source code is a one-way transformation. Virus analysts are skilled at going from machine code to assembler but are unable to go any further. By experience the researchers can tell which language and compiler is likely used to write an item of malware, but the techniques used in the Duqu framework were not out of the regular VXer cookbook, hence the appeal for help from the wider programming community.

Researchers at Kaspersky were the first to find the "smoking code" linking Stuxnet and Duqu. A detailed analysis of the Duqu code by Kaspersky researchers, can be found here.

More on how the language behind the Duqu language was deduced can be found here. ®

Similar topics

Broader topics


Other stories you might like

  • Most organizations hit by ransomware would pay up if hit again
    Nine out of ten organizations would do it all over again, keeping attackers in business

    Almost nine in 10 organizations that have suffered a ransomware attack would choose to pay the ransom if hit again, according to a new report, compared with two-thirds of those that have not experienced an attack.

    The findings come from a report titled "How business executives perceive ransomware threat" by security company Kaspersky, which states that ransomware has become an ever-present threat, with 64 percent of companies surveyed already having suffered an attack, but more worryingly, that executives seem to believe that paying the ransom is a reliable way of addressing the issue.

    The report, available here, is based on research involving 900 respondents across North America, South America, Africa, Russia, Europe, and Asia-Pacific. The respondents were in senior non-IT management roles at companies between 50 and 1,000 employees.

    Continue reading
  • APT gang 'Sidewinder' goes on two-year attack spree across Asia
    Launches almost 1,000 raids, plenty with upgraded malware

    Black Hat Asia The advanced persistent threat gang known as SideWinder has gone on an attack spree in the last two years, conducting almost 1,000 raids and deploying increasingly sophisticated attack methods.

    Noushin Shaba, a senior security researcher on Kaspersky's global research and analysis team, today told the Black Hat Asia conference that SideWinder mostly targets military and law enforcement agencies in Pakistan, Bangladesh and other South Asian nations. The gang has previously been associated with Indian actors, but Shaba said previous indicators that led to that attribution have disappeared – she was not confident tying the group to any nation.

    Shaba was, however, happy to declare that SideWinder has become one of the planet's most prolific attackers. Why the gang has stepped up its activities is not known. The Kaspersky researcher opined that perhaps its resources have increased, by means unknown.

    Continue reading
  • Emotet reestablishes itself at the top of the malware world
    Botnet infrastructure shut down last year, now central to a fast-spreading email scam, researchers say

    More than a year after essentially being shut down, the notorious Emotet malware operation is showing a strong resurgence.

    In a March threat index, Check Point researchers put the Windows software nasty at the top of its list as the most widely deployed malware, menacing or infecting as much as 10 percent of organizations around the globe during the month – a seemingly unbelievable estimate, and apparently double that of February.

    Now Kaspersky Labs says a rapidly accelerating and complex spam email campaign is enticing marks with fraudulent messages designed to trick one into unpacking and installing Emotet or Qbot malware that can steal information, collect data on a compromised corporate network, and move laterally through the network and install ransomware or other trojans on networked devices.

    Continue reading
  • Distributor dumps Kaspersky to show solidarity with Ukraine
    Security software vendor saddened but says its channel is holding firm

    Australian technology distributor Dicker Data has decided to end its commercial relationship with Russian security software vendor Kaspersky.

    CEO David Dicker told The Australian Financial Review the decision was taken out of a belief that Western nations have a responsibility to act, and because chief operating officer Vladimir Mitnovetski is Ukrainian so Dicker Data is therefore directly impacted by the illegal invasion.

    Kaspersky confirmed that Dicker Data has chosen to end its relationship, and thanked the distributor for "hard work, dedication and support" since taking on the account in 2019.

    Continue reading
  • Techniques to fool AI with hidden triggers are outpacing defenses – study
    Here's how to catch up with those poisoning machine-learning systems

    The increasingly wide use of deep neural networks (DNNs) for such computer vision tasks as facial recognition, medical imaging, object detection, and autonomous driving is going to, if not already, catch the attention of cybercriminals.

    DNNs have become foundational to deep learning and to the larger field of artificial intelligence (AI). They're a multi-layered class of machine learning algorithms that essentially try to mimic how a human brain works and are becoming more popular in developing modern applications.

    That use is expected to increase rapidly in the coming years. According to analysts with Emergen Research, the worldwide market for DNN technology will grow from $1.26bn in 2019 to $5.98bn by 2027, with demand in such industries as healthcare, banking, financial services and insurance surging.

    Continue reading
  • UK Cyber Security Centre advises review of risk posed by Russian tech
    Suggests it's prudent to plan for Putin weaponizing Russian products

    The UK's National Cyber Security Centre (NCSC) has advised users of Russian technology products to reassess the risks it presents.

    In advice that builds on 2017 guidance about technology supply chains that include links to hostile states, NCSC technical director Ian Levy stated that the agency has not found evidence "that the Russian state intends to suborn Russian commercial products and services to cause damage to UK interests."

    But he added that "the absence of evidence is not evidence of absence" – so "it would be prudent to plan for the possibility that this could happen."

    Continue reading
  • ‘Precursor malware’ infection may be sign you're about to get ransomware, says startup
    As more and more biz pays up to restore data, we're told

    Ransomware is among the most feared of the myriad cyberthreats circulating today, putting critical data at risk and costing some enterprises tens of millions of dollars in damage and ransoms paid. However, ransomware doesn't occur in a vacuum, according to security startup Lumu Technologies.

    A ransomware infection is usually preceded by what Lumu founder and CEO Ricardo Villadiego calls "precursor malware," essentially reconnaissance malicious code that has been around for a while and which lays the groundwork for the full ransomware campaign to come. Find and remediate that precursor malware and a company can ward off the ransomware attack is the theory.

    "The moment you see your network – and by network, I mean the network defined the modern times, whatever you have on premises, whatever is out in the clouds, whatever you have with your remote users – when you see any assets from your network contacting an adversarial infrastructure, eliminate that contact because that puts you in your zone of maximum resistance to attacks," Villadiego told The Register.

    Continue reading

Biting the hand that feeds IT © 1998–2022