Loading malware…
Duqu is a highly sophisticated Windows malware platform first publicly identified in 2011 and widely regarded as part of the same development lineage as Stuxnet. It has been associated with targeted espionage operations and is notable for its modular architecture, stealth-focused execution, and use in high-end intrusions. Reporting has also described an intermediate evolutionary stage sometimes referred to as Duqu 1.5, reinforcing the view that the platform evolved over time as part of a broader state-linked toolset.
Duqu operates as a modular espionage malware family with reconnaissance and information-theft functionality. Documented modules can collect process details, enumerate local network configuration, capture keystrokes, and stage collected data for theft by copying it to an intermediate location, compressing it, and encrypting it before exfiltration. Its command-and-control communications have been observed using AES-CBC encryption, and the malware supports delivery and execution of additional modules after compromise.
The malware emphasizes stealth and defense evasion. It can inject itself into other processes, with target selection influenced by the security software present on the victim system, and it is capable of loading executable code through process hollowing. Duqu has also abused the signed Windows Installer utility to execute malicious installer packages, including use of installer properties to decrypt embedded payloads. Some reporting additionally associates Duqu with steganographic concealment techniques in broader discussions of advanced espionage tradecraft.
Persistence and privileged execution have been achieved through Windows service abuse. Duqu has created a new service that loads a malicious driver at system startup, and the driver was made to appear legitimate through code signing. Lateral movement has also been documented: operators could use compromised credentials to schedule tasks on remote Windows systems in order to execute the malware across the environment.
Duqu is best characterized as an espionage-oriented modular backdoor or infostealing platform used in targeted attacks. Its observed behavior spans reconnaissance, credential-adjacent collection through keylogging, process injection, persistence via services, encrypted command-and-control, staged exfiltration, and lateral movement within Windows networks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The formidable Duqu was first discovered in 2011 by CrySyS Lab and extensively researched by GReAT.
CVE-2011-3402 (Windows TrueType Font Parsing RCE) Vulnerability in the Windows kernel’s TrueType font parsing engine (win32k.sys)... Used in attacks linked to targeted threats (e.g., Duqu malware family). ... patched in December 2011. | Used in attacks linked to targeted threats (e.g., Duqu malware family).
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers connected Duqu to the development of Stuxnet early on.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"
"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"
"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Duqu and Stuxnet both use a kernel driver to decrypt and load encrypted DLL (Dynamic Load Library) files. The kernel drivers serve as an “injection” engine to load these DLLs into a specific process.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
SIG4 ... Snake/Uroburos ... fdisk.sys driver ... SIG35 ... most likely related to Duqu ... looks for kernel driver ... SIG8 StuxNet ... mrxcls.sys, mrxnet.sys, s7otbxdxa.sys drivers.
“Duqu… a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.”
hiding payload inside PNGs using LSB steganography... Least Significant Bit (LSB) Steganography, which hides data inside the LSBs of image pixel values. This allows attackers to embed payload within an image file without altering its visual appearance.
installs drivers and encrypted DLLs... The PNF file is an encrypted DLL that is decrypted and injected into arbitrary system processes.
temporary Windows files generated by Wiper begin with a tilde character (~), followed by the letter d (either capital or lower case), followed by other letters or numbers. This “tilded platform,” as researchers have come to call the convention, is also found in both Stuxnet and Duqu.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Duqu and Stuxnet both use a kernel driver to decrypt and load encrypted DLL (Dynamic Load Library) files. The kernel drivers serve as an “injection” engine to load these DLLs into a specific process.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
And while Stuxnet and Duqu each “have variants where the kernel driver file is digitally signed using a software signing certificate,” Dell says this commonality is insufficient evidence of a connection “because compromised signing certificates can be obtained from a number of sources.”
Multiple malware families are described as identifying/enumerating open windows or capturing foreground window titles (e.g., via EnumWindows, GetForegroundWindow, GetWindowText) to understand user activity and provide context for keylogging/screencapture.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
They check for the existence of specific files, windows registry entries, and other signs ... For example, this script looks for the existence of an actual file “winver32.exe” in the very specific $docsandsettings\\$subkey\\Application Data\\winver32.exe path.
"spread laterally by copying itself to shares... for which it has obtained legitimate credentials"; "hard-coded credentials to gain access to a network share"
It communicates with a command server in India... Both groups above also contain another module, sortXXXX.nls... It seems to be responsible for the malware’s malicious activities, such as command and control communications.
The code in question is part of the Payload DLL, a section of the trojan that sends and receives instructions from an outside source once it has infiltrated a system.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed among historically significant sophisticated malware families that drew deep technical analysis.
An information-stealing rootkit described as having been based on Stuxnet.
Malware used to gather information on industrial systems.
An information-stealing malware related to Stuxnet, apparently tailored to steal information from industrial control systems rather than sabotage them.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.