Rovnix bootkit framework updated - Revision history

Eric.freyssinet at 22:48, 30 July 2015

2015-07-30T22:48:35Z

← Older revision		Revision as of 22:48, 30 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Image~~=		\|Botnet=Rovnix,
	\|~~Legend~~=		\|Malware=,
			\|CCProtocol=,
			\|Year=2012
			\|Date=July 14, 2012
			\|Editor=ESET
			\|Link=http://blog.eset.com/2012/07/13/rovnix-bootkit-framework-updated
			\|Author=Aleksandr Matrosov,
			\|Abstract=We have been tracking the activity of the Rovnix bootkit family since April 2011. Rovnix was the first bookit family to use VBR (Volume Boot Record) infection (NTFS bootstrap code) for loading unsigned kernel-mode drivers on x64 (64 bit) platforms. The reason for exploring further is the desire of the Rovnix developers to bypass antivirus detection. The payload of the first samples in the wild blocked internet connection for Russian users and forced them to send an SMS to a premium number in order to get their connection unblocked (Hasta La Vista, Bootkit: Exploiting the VBR).
	\|Document=		\|Document=
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	~~\|Link=http://blog.eset.com/2012/07/13/rovnix-bootkit-framework-updated blog.eset.com~~
	~~\|Author=Aleksandr Matrosov,~~
	\|NomRevue=ESET Threat Blog		\|NomRevue=ESET Threat Blog
	~~\|Date=July 14, 2012~~
	~~\|Editor=ESET~~
	~~\|Year=2012~~
	\|ISBN=		\|ISBN=
	\|Page=		\|Page=
	\|Abstract=We have been tracking the activity of the Rovnix bootkit family since April 2011. Rovnix was the first bookit family to use VBR (Volume Boot Record) infection (NTFS bootstrap code) for loading unsigned kernel-mode drivers on x64 (64 bit) platforms. The reason for exploring further is the desire of the Rovnix developers to bypass antivirus detection. The payload of the first samples in the wild blocked internet connection for Russian users and forced them to send an SMS to a premium number in order to get their connection unblocked (Hasta La Vista, Bootkit: Exploiting the VBR).		\|Operation=,
	~~\|Botnet=Rovnix,~~		\|Keyword=,
	~~\|Malware=,~~
	~~\|CCProtocol=,~~
	\|Operation=,
	\|Keyword=,
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:27:10Z

1 revision imported

← Older revision		Revision as of 14:27, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement du texte — « Eset » par « ESET »

2012-08-19T17:54:46Z

Remplacement du texte — « Eset » par « ESET »

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blog.eset.com/2012/07/13/rovnix-bootkit-framework-updated blog.eset.com
|Author=Aleksandr Matrosov,
|NomRevue=ESET Threat Blog
|Date=July 14, 2012
|Editor=ESET
|Year=2012
|ISBN=
|Page=
|Abstract=We have been tracking the activity of the Rovnix bootkit family since April 2011. Rovnix was the first bookit family to use VBR (Volume Boot Record) infection (NTFS bootstrap code) for loading unsigned kernel-mode drivers on x64 (64 bit) platforms. The reason for exploring further is the desire of the Rovnix developers to bypass antivirus detection. The payload of the first samples in the wild blocked internet connection for Russian users and forced them to send an SMS to a premium number in order to get their connection unblocked (Hasta La Vista, Bootkit: Exploiting the VBR).
|Botnet=Rovnix,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}