https://www.botnets.fr/index.php?action=history&feed=atom&title=Rovnix.D%3A_the_code_injection_storyRovnix.D: the code injection story - Revision history2026-10-25T03:16:51ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=Rovnix.D:_the_code_injection_story&diff=2344&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:27:11Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:27, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-2343:rev-2344 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=Rovnix.D:_the_code_injection_story&diff=2343&oldid=prevEric.freyssinet: Remplacement du texte — « Eset » par « ESET »2012-08-19T17:54:22Z<p>Remplacement du texte — « Eset » par « ESET »</p>
<p><b>New page</b></p><div>{{Publication<br />
|Image=Rovnix.D Story.png<br />
|Legend=<br />
|Document=<br />
|Licence=<br />
|Video=<br />
|Link=http://blog.eset.com/2012/07/27/rovnix-d-the-code-injection-story blog.eset.com<br />
|Author=Aleksandr Matrosov, <br />
|NomRevue=ESET Threat Blog<br />
|Date=July 27 2012<br />
|Editor=ESET<br />
|Year=2012<br />
|ISBN=<br />
|Page=<br />
|Abstract=In the one of my previous blog posts I described the bootkit functionality included in modifications found in new Rovnix.D samples (Rovnix bootkit framework updated), but further detailed analysis uncovered some interesting updates to the code injection technique employed. During the Rovnix.D code analysis process we found algorithms for multiple code injections with a range of payloads. In previous versions Rovnix worked with a single payload, and the Rovnix developer concentrated on the sales framework for that specific payload. In the new version we see multiple code injections into user-mode processes launched from hidden storage, opening up more ways in which the botnet can be leased. But right now we aren’t aware of large botnets based on Rovnix.D, and the C&C indicates that the number of currently active bots is 8,417.<br />
|Botnet=Rovnix, <br />
|Malware=Rovnix.D, <br />
|CCProtocol=, <br />
|Operation=, <br />
|Keyword=, <br />
}}</div>Eric.freyssinet