DAGGER_PANDA__2015__duqu2_crysys.pdf

This CrySyS Lab technical report analyzes Duqu 2.0 samples received in 2015 and compares them to the original Duqu, demonstrating numerous code and behavior similarities (string decryption, AES/CTS-like config encryption, logging structures, import hashing, and C2 mechanisms), providing IOCs (sample hashes, GIF payload, YARA rules) and concluding the threat is a sophisticated APT-class cyber-espionage actor likely reusing and evolving prior Duqu toolsets.