4 min read

No More Rootkit in ZeroAccess?

Răzvan STOICA

May 18, 2012

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
No More Rootkit in ZeroAccess?

The ZeroAccess crimeware package has beed made rather much of, in view of its advanced kernel-mode rootkit driver. The Sirefef rootkit is highly aggressive and rather hard to detect; it exhibits polymorphism, overwrites legitimate system driver files to replace them with its own and in some versions it even tries to shut down AV software .

However, recent versions seem to have left out this particular “feature”.E-threat researcher Biro Balazs explains:

‘The infection mechanism is the same as that of older versions (the initial dropper comes as a flash player installer from porn sites), but it lacks the usual components, particularly the x86 rootkit component(rtk32).

In both of the cases the dropper has an embedded Microsoft Cabinet File which contains the components:

But, as we can see, the new dropper contains only:fp.exe (the clean flash player installer) plus n32 ( p2p.32.dll) and n64 (p2p.64.dll), whereas the x86 rootkit component (rtk32) is missing. (Note: Only the important files have been highlighted):

Instead, it has two dlls(p2p.32.dll and p2p.64.dll). which are responsible for downloading further plugins. In our tests the 32 bit dll hasn’t downloaded any rootkit component, this could mean that this part of the infection mechanism has been left out of the game.

But why would the authors leave out the rootkit? One possible cause is the aggressive nature of the rootkit. By overwriting a legitimate driver, it risks rendering the system non-bootable (it might get deleted by an anti-malware solution).

In this case the VX-ers would lose control over the system, which obviously isn’t their goal.

For surviving the reboot, the package employs a technique also used by the first Sirefef/ZeroAccess variant (with the strange path “\\??\globalroot\Device\__max++>\”), namely CLSID hijacking – replacing the InprocServer32 entry from a well known ClassId from HKLM\Software\Classes\CLSID.

Ironically, the new, rootkit-less versions are easier to detect, so if we’d live in a perfct world where everyone runs antivirus software, ZeroAccess would be on its way out.’

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Strict//EN” “DTD/xhtml1-strict.dtd”>
<body><div class=”noquote”><div dir=”ltr”>he infection mechanism is the same as that of older versions (the initial</div><div dir=”ltr”>dropper comes as a flash player installer from porn sites), but it lacks the</div><div dir=”ltr”>usual components, particularly the x86 rootkit component(rtk32). (eventual</div><div dir=”ltr”>as putea sa pun un print screen aici cu diferentele).&nbsp;</div><div dir=”ltr”>Instead it has two dlls(p2p.32.dll and p2p.64.dll). These are responsible for&nbsp;</div><div dir=”ltr”>downloading further plugins.&nbsp;</div><div dir=”ltr”>In our tests the 32 bit dll hasn’t downloaded any rootkit component, this</div><div dir=”ltr”>could mean that this part of the infection mechanism has been left out&nbsp;</div><div dir=”ltr”>of the game. (nu pot sa fiu sigur 100% ca nu descarca rootkitul).</div><div dir=”ltr”>But why would the authors leave out the rootkit? One possible cause is&nbsp;</div><div dir=”ltr”>the aggressive nature of the rootkit. By overwriting a legitimate driver it&nbsp;</div><div dir=”ltr”>risks rendering the system non-bootable (it might get deleted by an anti-</div><div dir=”ltr”>malware solution).</div></div><div class=”quotelevel1″><div dir=”ltr”>&gt; In both cases, this represents loss of control over a system, for the VX-</div><div dir=”ltr”>&gt; ers.</div></div><div class=”noquote”><div dir=”ltr”>In this case the VX-ers would lose control over the system, which&nbsp;</div><div dir=”ltr”>obviously isn’t their goal.</div><div dir=”ltr”>For surviving the reboot it employs a technique also used by the first&nbsp;&nbsp;</div><div dir=”ltr”>Sirefef/ZeroAccess variant (with the strange path&nbsp;</div><div dir=”ltr”>”\\??\globalroot\Device\__max++&gt;\”), namely CLSID Hijacking.&nbsp;</div><div dir=”ltr”>(Replacing the InprocServer32 entry from a well known ClassId from&nbsp;</div><div dir=”ltr”>HKLM\Software\Classes\CLSID).</div></div></body>

tags


Author



Right now

Top posts

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

July 21, 2021

9 min read
How We Tracked a Threat Group Running an Active Cryptojacking Campaign

How We Tracked a Threat Group Running an Active Cryptojacking Campaign

July 14, 2021

10 min read
A Note from the Bitdefender Labs Team on Ransomware and Decryptors

A Note from the Bitdefender Labs Team on Ransomware and Decryptors

May 26, 2021

2 min read
New Nebulae Backdoor Linked with the NAIKON Group

New Nebulae Backdoor Linked with the NAIKON Group

April 28, 2021

1 min read
Good riddance, GandCrab! We’re still fixing the mess you left behind.

Good riddance, GandCrab! We’re still fixing the mess you left behind.

June 17, 2019

5 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Poking Holes in Crypto-Wallets: A Short Analysis of BHUNT Stealer Poking Holes in Crypto-Wallets: A Short Analysis of BHUNT Stealer
Bitdefender

January 19, 2022

2 min read
Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand
Bogdan BOTEZATU

November 08, 2021

2 min read
Digitally-Signed Rootkits
are Back – A Look at
FiveSys and Companions Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions
Cristian Alexandru ISTRATEBalazs BIRORareș Costin BLEOTUClaudiu COBLIȘ
1 min read