## 2 Duqu
### Duqu Detector Toolkit  
Duqu is a sophisticated malware that has avoided detection for a period of time that shocked malware analysts. The exact start of the Duqu operation is still unsure today, but the stealthy period of the malware spans several months, maybe years. The authors achieved this robustness with rigorous quality control, the use of advanced obfuscation techniques and thorough cleaning of activity traces. Yet, thorough investigations uncovered several points where the malware authors could not fully cover their traces. We collected our observations and developed a set of heuristic tools to detect Duqu and, with a high chance, other variants of the same platform, including Stuxnet. Given the potential impact of false negatives, our tools aim at completeness rather than precision, and the results of the detection tools require a careful investigation by security experts. At the time of this writing, we provide six tools [9] to heuristically detect Duqu variants and our tools can be broadly categorized into three areas: detecting file existence anomalies (_FindDuquSys_, _FindDuquTmp_, _FindPNFnoINF_), detecting properties of files and registry entries (_CalcPNFEntropy_, _FindDuqReg_) and analyzing code injection into running processes (_FindInjectedSections_). The outputs of these tools are stored in a log file, where suspicious files, memory regions and registry entries areindicated together with their corresponding hashes. Note that while some of these tools are rather simple and would be easy to defeat by changing the malware, they can still be used to detect existing infections. In addition, some of these tools are general and defeating them would require substantial change in the malware. 1. _FindDuquSys_. This tool recursively tries to find the.sys kernel driver file of Duqu. It works similarly to signature based anti-virus detectors and uses binary signature matching on all driver files in predefined directories, such as system32 drivers and System Volume Information directory (this extension was introduced to be able to search deleted files as well). The signature components were selected in a way that modified versions of Duqu might be detected as well. It is not impossible, however, that our tool can detect these signatures in legitimate files, so if any string is detected, it is just an indication for the need of detailed manual analysis of the particular file. Care should be taken that running the program might need elevated privileges to successfully test all.sys files. 2. _FindDuquTmp_. The Duqu malware got its name after the usage of temporary files starting with \(\sim\)DQ. In fact, the detection tool seeks multiple types of temporary files used in Duqu: * The existence of \(\sim\)DN1.tmp shows that the keylogger/infostealer component might be installed on the computer. Our tool checks files recursively in predefined temporary directories, _i.e._, Temp directories of all the users and the Windows Temp directory. * \(\sim\)DQ\(\ast\) files might be related to the keylogger/infostealer log files. Some parts of the files are checked against Duqu's magics. * \(\sim\)DF\(\ast\) are compressed files created by a yet unknown part of Duqu and contain information gathered at the target computer. Our tool checks those files if they begin with a modified bzip magic, which shows that the temporary file is likely related to Duqu. 3. _FindPNFenINF_. The PNF files installed by Duqu do not have the corresponding INF files. The tool checks all PNF files in Windows INF directory (located at %WINDIR\(\lx@sectionsign\)inf), and indicates if some file does not have a related file with INF extension. Improper uninstallation of drivers can also cause such anomaly, so this does not necessarily signal the existence of Duqu. Experts should carefully check the results of the tool for false positives. 4. _CalcPNFEntropy_. This tool tries to find suspicious PNF files in both the Windows installation and the System Volume Information directories.