Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Malware
  New Posts New Posts RSS Feed: Rustock Trojan Series
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Topic ClosedRustock Trojan Series
 Post Reply Post Reply Page  <1 567
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Online Status: Offline
Posts: 4753 		Direct Link To This Post Topic: Rustock Trojan Series
    Posted: 30 August 2007 at 7:32pm
Originally posted by SystemPro

I guess it comes from ZoneAlarm.


Yes.

Hi, fcukdat.

I can only guess, that this rootkit Srizbi is based on PE386 earlier sources, which perhaps were sold to somebody.

Originally posted by Elite

Rustock.D???

What ever happened to Rustock.C? I have yet to come across anything more advanced than Rustock.B.

I'd imagine pe386 is using the method of drive hiding that he used in phide_ex demo and like you had planned in later Unreal variants?

I'd guess new Rustocks can also bypass raw disk scanning too?


This is not confirmed information from our sources. And we think that is true.

It is hard to imagine that we have two completely undetected malware rootkits and very hard to believe, especially after releases of so many antirootkits and their evolution last year.

We think that new rootkit uses packer of driver/dropper similar to phide_ex but more advanced. We think it also undetectable by current level of implementation RkU and out-of-date tools like GMER or IceSword (I do not telling about other ark, because they are sh*t).

Thats is pure theory.

Getting only one workable dropper of C or D can do a revolution in rkdetection.
Ring0 - the source of inspiration
Back to Top
fcukdat View Drop Down
Senior Member
Senior Member
Avatar

Joined: 02 September 2006
Location: United Kingdom
Online Status: Offline
Posts: 374 		Direct Link To This Post Posted: 30 August 2007 at 4:12pm
Hey EP
 
Just following on from a post you made at wilders and speculating about timelines etc
Mni41.sys is the PE386 rootkit, based on Rustock.B, we can said that because it contains tcp/ip stack machine unique to all rustocks and packer similar to Rustock.B but more weak. So we have another variant of rustock. But we can't call it C, because it is very weak in self-defense abilities. So we can guess that this is simple prototype of B variant. Also very interesting that it is trying to remove competitors - ntio256.sys and runtime2.sys
 
 
Runtime2.sys(Cutwail/Bulknet) first started appearing around Feb07+
 
Since Srizbi targets a malware that did'nt appear until long after many type B were in the wild maybe it is C variant afterall ?
 
 
___________
Ade Gill
Malwarebytes Researcher

Back to Top
Elite View Drop Down
Senior Member
Senior Member
Avatar

Joined: 15 April 2007
Location: United States
Online Status: Offline
Posts: 175 		Direct Link To This Post Posted: 30 August 2007 at 1:38pm
Rustock.D???

What ever happened to Rustock.C? I have yet to come across anything more advanced than Rustock.B.

I'd imagine pe386 is using the method of drive hiding that he used in phide_ex demo and like you had planned in later Unreal variants?

I'd guess new Rustocks can also bypass raw disk scanning too?
Back to Top
SystemPro View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 April 2007
Location: Germany
Online Status: Offline
Posts: 504 		Direct Link To This Post Posted: 30 August 2007 at 12:00pm
It is pure mathematics.

Ah okay, like this pill thing of Rutkowska, I forgot the original name of this little matrix checker, but something with pill..

Bypassing firewalls is possible by using yourself implemented tcp/ip stack machine and direct work with network hardware. Prevx can claim everything what it want.

Yes, probably there are many possibilities.

Beside I checked the last RKu version and found for the first time stealth code:
Unknown page with executable code
Address: 0x86904D92
Size: 622
Unknown page with executable code
Address: 0x86823DE2
Size: 542
Unknown page with executable code
Address: 0x86818BD8
Size: 1064
Unknown page with executable code
Address: 0x868189C9
Size: 1591
Unknown page with executable code
Address: 0x8681D706
Size: 2298

ntkrnlpa.exe-->IoCreateDevice, Type: EAT modification at address 0x8066E574 hook handler located in [unknown_code_page]
868185E0
tcpip.sys-->ntkrnlpa.exe-->IoCreateDevice, Type: IAT modification at address 0xAED72F88 hook handler located in [unknown_code_page]
868185E0
wanarp.sys-->ntkrnlpa.exe-->IoCreateDevice, Type: IAT modification at address 0xF763CC08 hook handler located in [unknown_code_page] 868185E0
tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xAED72F54 hook handler located in [vsdatant.sys]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xAED72F60 hook handler located in [vsdatant.sys]

I guess it comes from ZoneAlarm.



Edited by SystemPro - 30 August 2007 at 12:08pm
Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Online Status: Offline
Posts: 4753 		Direct Link To This Post Posted: 30 August 2007 at 6:49am
Detection of software VM doesn't need "signatures" or something like that. It is pure mathematics. Bypassing firewalls is possible by using yourself implemented tcp/ip stack machine and direct work with network hardware. Prevx can claim everything what it want.
Ring0 - the source of inspiration
Back to Top
SystemPro View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 April 2007
Location: Germany
Online Status: Offline
Posts: 504 		Direct Link To This Post Posted: 30 August 2007 at 3:57am
Rustock.C (2006)
??Rustock.D (2007?)

Deep kernel mode implementation
All firewalls and antiviruses bypassing
Self defense (DKOM and partially DKOH)
Anti antirootkit part (most popular antirootkits are bypassed)
Anti vm (vm's are detected and execution prevented)
Anti debugging
Polymorphic packer for drivers and droppers (unique, private packer+protector for drivers)


I guess they donīt know all vmīs, so detection is possible with unknown vmīs. Bypassing of all firewalls and avs is possible by corrupting/circumventing virtual memory, right? (at least Prevx claims that)
Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Online Status: Offline
Posts: 4753 		Direct Link To This Post Posted: 30 August 2007 at 1:19am
windev.sys


Thank you, it would be really interesting to see what is it.
Ring0 - the source of inspiration
Back to Top
fcukdat View Drop Down
Senior Member
Senior Member
Avatar

Joined: 02 September 2006
Location: United Kingdom
Online Status: Offline
Posts: 374 		Direct Link To This Post Posted: 30 August 2007 at 1:10am
Thanks for the history updateSmile
 
I have windev.sys driver in my zoo and quite a few Rustock variants.I will upload/share them for your inspection !
___________
Ade Gill
Malwarebytes Researcher

Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Online Status: Offline
Posts: 4753 		Direct Link To This Post Posted: 29 August 2007 at 9:16pm
Hello,

Rustock trojan series is the most technically advanced malware from the available today. Unique part of this trojan is deep kernel mode implementation, antidetection and networking.

List of currently available Rustock and its variants (maybe not full).
Most of them was revealed with free HIDS tools or with help of HIPS.

i386.sys
sysbus32.sys (2006)
wincom32.sys (2006?)

SSDT patching and IRP hooking

??windev.sys (2006?)

No information

pe386.sys (2006)

Featured SYSCALL hooking / driver stealth

mni41.sys (2006)*

*Could have random driver name.
SSDT inline hooking, IRP hooking
Packed with polymorphic protector similar to next versions
TCP/IP stack machine (firewalls bypassing)
Competitors removal (ntio256.sys and runtime2.sys)

As you can see, this version was detected only few month ago.

huy32.sys (2006)

Beta of Rustock.B
Contains several functionality from the main version

lzx32.sys (2006)

Currently the most advanced kernel mode rootkit that was detected.
SYSCALL inline hooking
ADS implemented hidding (different variants uses different ways to do that)
TCP/IP stack machine (firewalls bypassing)
Advanced antidetection (contains black list of antirootkits - RKR, IceSword, DarkSpy, Blacklight, GMER)
Dropper and driver are packed with advanced protector

Rustock.C (2006)
??Rustock.D (2007?)

Deep kernel mode implementation
All firewalls and antiviruses bypassing
Self defense (DKOM and partially DKOH)
Anti antirootkit part (most popular antirootkits are bypassed)
Anti vm (vm's are detected and execution prevented)
Anti debugging
Polymorphic packer for drivers and droppers (unique, private packer+protector for drivers)

For us is completely no sense for which purposes ("ethical aspects" and other sh*t) was developed this series and what its doing right now. We interested only in rootkit technology itself, because it can (and previous versions already) dramatically improve detection abilities of all currently developed modern antirootkits (RkU, gmer, IceSword).

So if somebody can add some information about Rustock or something about its multiple variants we will be happy.
Ring0 - the source of inspiration
Back to Top
 Post Reply Post Reply Page  <1 567

Forum Jump Forum Permissions View Drop Down