Duqu Alive And Well: New Variant Found In IranResearchers at Symantec dissect part of new, retooled version of the reconnaissance-gathering malware
quote:
The creators of Duqu may not have used traditional malware writers to craft their code, but they have done something that malware writers do: released a new variant of their code with just enough tweaks to evade detection.
A day after researchers from Kaspersky Lab revealed that with the help of the security community, they had cracked the mystery of the programming language used in Duqu, researchers from Symantec yesterday announced that they had discovered a new variant of Duqu -- the first one spotted since October of last year. The first two were found in the wild in November of 2010.
Vikram Thakur, principal manager at Symantec Security Response, says the creators of Duqu -- which Symantec and Kaspersky agree are the same ones who are behind Stuxnet -- basically changed a few bytes here and there to allow the malware to sneak past detection tools including an open-source one built by the Laboratory of Cryptography and System Security (CrySyS Labs). "This is round two of the same thing: the old code, tweaked a bit," Thakur says.
They changed the encryption algorithm and rather than employing a stolen digital certificate as they had done before, the attackers instead used a phony Microsoft cert to make the driver appear to be legitimate. The sample discovered by Symantec came out of Iran, Thakur says, and it's just one piece of the malware package: specifically, the "loader," which installs the rest of the malware when the victim's machine restarts. The compile date on the malware is February 23, 2012.
More 
