Eric.freyssinet: 1 revision imported

2015-02-07T14:23:23Z

1 revision imported

← Older revision		Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet at 17:18, 19 August 2012

2012-08-19T17:18:06Z

New page

{{Publication
|Image=rovnixb_eset.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blog.eset.com/2012/02/22/rovnix-reloaded-new-step-of-evolution blog.eset.com
|Author=David Harley, Aleksandr Matrosov, Eugene Rodionov,
|NomRevue=ESET Threat Blog
|Date=February 22, 2012
|Editor=ESET
|Year=2012
|ISBN=
|Page=
|Abstract=In the beginning of February we found a new modification of our “old friend” Win32/Rovnix (the dropper detected as Win32/Rovnix.B trojan), which is the first bootkit using VBR (Volume Boot Record) infection. An interesting fact is that Rovnix bootkit components were used in Win32/Carberp, the most widely spread banking trojan in Russia. You can get more information about modern Carberp evolution facts in our forthcoming presentation “Carberp Evolution and BlackHole: Investigation Beyond the Event Horizon” at CARO 2012.

And now we are seeing a new step of evolution for the Rovnix bootkit family.

We can see interesting tracking strings in the unpacked dropper:

The version has been changed to 2.1, but we’ve seen the same strings before in the Win32/Carberp dropper with bootkit, allowing us to draw some conclusions:

In the Win32/Carberp dropper we’ve seen version number 2.1 among debugging strings but in the latest samples version 2.5 is used.
|Botnet=Carberp,
|Malware=Rovnix, Carberp_(bot), TDL3, TDL3+, TDL4, Olmasco, ZeroAccess,
|ExploitKit=Blackhole
|CCProtocol=,
|Operation=,
|Keyword=bootkit, Blackhole,
}}

Rovnix Reloaded: new step of evolution - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 17:18, 19 August 2012