Stealthy Universal Rootkit Enables Direct Loading Of Second-Stage Payload

The discovery of a new stealthy universal rootkit has raised concerns in the cybersecurity community. This rootkit allows attackers to load a second-stage payload directly, posing a significant threat to computer systems. The rootkit employs various approaches to sign malicious kernel drivers, including exploiting Microsoft signing portals, using leaked and stolen certificates, and underground services. As a result, hunting for these rootkits has become more challenging due to the increase in the number of 64-bit signed drivers and the implementation of kernel mode code signing policies. The installation process of the rootkit loader involves several steps, such as installing a 64-bit signed driver, disabling User Account Control and Secure Desktop mode, editing the registry, and generating different domains using a Domain Generating Algorithm. Additionally, the rootkit utilizes evasion techniques to avoid detection, such as stopping Windows Defender and disabling anti-spyware detection. This type of rootkit is commonly employed by sophisticated groups who possess advanced reverse-engineering skills and develop specialized tools.

Key Takeaways

• Malicious kernel drivers can be signed using various approaches such as abusing Microsoft signing portals, using leaked and stolen certificates, and underground services.
• Hunting for 64-bit signed rootkits is difficult due to the increase in the number of such drivers and the introduction of kernel mode code signing (KMCS) policies mechanisms.
• The installation process of the rootkit loader involves steps like installing a 64-bit signed driver, disabling User Account Control (UAC) and Secure Desktop mode, editing the registry, generating different domains using a Domain Generating Algorithm (DGA), and establishing a TCP socket for communication.
• The second-stage driver of the rootkit exhibits characteristics like being unsigned, reading and writing the first-stage driver to the registry, deleting the first-stage driver from the disk, and employing evasion techniques such as stopping Windows Defender software and disabling anti-spyware detection.

Installation Process

The installation process of the rootkit loader involves various steps. Firstly, a 64-bit signed driver is installed to ensure the rootkit’s compatibility with the operating system. Additionally, User Account Control (UAC) and Secure Desktop mode are disabled, which allows the rootkit to bypass security measures and gain elevated privileges. The registry is then edited, and Winsock Kernel (WSK) objects are initialized to establish communication channels. To evade detection, the rootkit employs a Domain Generating Algorithm (DGA) to generate different domains, making it difficult to track. Finally, a TCP socket is established for communication with the Command and Control (CC) server. By disabling UAC and Secure Desktop mode and generating different domains using DGA, the rootkit loader ensures a stealthy installation process.

Actions of the Downloader

Upon receiving encrypted data from the Command and Control server, the downloader decrypts the data and loads the Portable executable file into memory without writing to the disk. This ensures that the malicious payload remains stealthy and difficult to detect. The decryption process allows the downloader to access the actual content of the payload, which is usually obfuscated to evade detection by security tools. Once loaded into memory, the payload can execute its malicious activities, such as establishing a connection with the attacker’s infrastructure and performing various malicious functions.

To provide a deeper understanding of the actions of the downloader, the following table highlights key aspects of the decryption process and the proxy installation that may be employed:

By incorporating these techniques, the downloader can establish communication with the attacker’s infrastructure while evading detection and maintaining a covert presence on the compromised system.

Evasion Techniques

Evasion techniques employed by the downloader aim to bypass detection and maintain covert presence on the compromised system. To achieve this, the downloader utilizes various strategies, including:

• Disabling detection: The downloader actively attempts to stop Windows Defender software and disables anti-spyware detection by modifying registry keys and the SecurityHealthService. By doing so, it can evade detection and continue its malicious activities without interference.

• Proxy installation: Another technique employed by the downloader is the installation of a proxy on the compromised machine. This allows the attacker to redirect web browsing traffic to a remote proxy server, giving them control over the victim’s internet activities. The downloader further manipulates the Windows proxy configuration to ensure seamless redirection.

These evasion techniques enable the downloader to operate stealthily, making it challenging for security measures to detect and mitigate its activities. By disabling detection mechanisms and establishing proxy connections, the downloader can maintain its covert presence and carry out malicious actions undetected.

Frequently Asked Questions

What is a rootkit and how does it work?

A rootkit is a type of malicious software that enables unauthorized access and control over a computer system. It operates at a low level, hiding its presence and allowing attackers to bypass security measures. Rootkits can be difficult to detect and remove, posing a significant challenge for security professionals.

What are some common methods used to sign malicious kernel drivers?

Common methods used to sign malicious kernel drivers include abusing Microsoft signing portals, using leaked and stolen certificates, and utilizing underground services. These techniques pose a significant challenge to detecting and removing malicious kernel drivers, impacting system security.

How does the rootkit loader establish communication with the Command and Control (CC) server?

The rootkit loader establishes communication with the command and control (CC) server through a TCP socket. It initiates a connection with the server, receives encrypted data, decrypts it, and loads the payload into memory without writing to the disk.

What are some characteristics of the second-stage driver downloaded by the rootkit?

The characteristics of the second-stage driver downloaded by the rootkit include its unsigned status, the ability to read and write the first-stage driver to the registry, and the capability to delete the first-stage driver from the disk. Its functionality involves evading detection by stopping Windows Defender software and disabling anti-spyware detection from the registry key and SecurityHealthService.

What are some examples of evasion techniques employed by the second-stage driver?

Some evasion techniques employed by the second-stage driver include stopping Windows Defender software and disabling anti-spyware detection from the registry key and SecurityHealthService. These techniques allow the driver to avoid detection by security measures.