Zerosecurity
  • Home
  • Security
    • Exploits
    • Mobile Security
  • Malware
  • Data Breaches
  • Crypto
  • Privacy
  • Downloads
    • Malwarebytes
    • Exploits
    • Paper Downloads
    • Software & Service Reviews
No Result
View All Result
SUBSCRIBE
Zerosecurity
  • Home
  • Security
    • Exploits
    • Mobile Security
  • Malware
  • Data Breaches
  • Crypto
  • Privacy
  • Downloads
    • Malwarebytes
    • Exploits
    • Paper Downloads
    • Software & Service Reviews
No Result
View All Result
Zerosecurity
No Result
View All Result
Home Malware

Guntior Bootkit upgraded

Paul Anderson by Paul Anderson
June 12, 2013 - Updated on June 26, 2013
in Malware, Malware Analysis, Public
0
74
SHARES
1.2k
VIEWS
Share on FacebookShare on Twitter

Sophos reports that the Guntior, malware out of China has resurrected with master boot record (MBR) infection techniques and has been common for a while now.

You might also like

Syslogk Linux Rootkit triggers with magic packets

BlackCat Ransomware aka “ALPHV” infections on the rise

State-sponsored Iranian Hackers utilize .NET DNS Backdoor in new Attack

These new techniques implemented are to bypass security mechanisms such as Windows PatchGuard and kernel driver signing which were introduced in Windows Vista and up.

Many new malware has adopted these techniques ranging from those that entirely overwrite the MBR with a malevolent loader to ones that manipulate values to alter loading offsets to hijack the boot process.

Sophos has also did a analysis of the dropper, you can view the bootkit analysis here.

The dropper

The dropper has two execution branches. One is a dynamic link library (DLL) and the other is an executable.

Figure 6

Throughout its execution down the “exe” path it maintains a log file in the %Temp% directory called ‘stinst.log’ to capture information such as the OS version and its randomly generated name when it copies itself to the system32 directory.

It also makes sure that the %Temp% directory is appended to the PATH environment variable.

The dropper relies on the system time as a seed to generate random names for itself and its dropped components.

It also names a copy of itself msimg32.dll in the %Temp% directory, creates a copy of HelpCtr.exe in the %TEMP% directory, and alters the PEFlags in the new copy of msimg32.dll so that they indicate that the file is a dll.

fig7 500

HelpCtr.exe is a clean Windows file that imports calls from msimg32.dll, which is normally found in the system folder.

As you may have guessed from its name, HelpCtr.exe starts the Windows Help and Support Center homepage.

By ensuring that %TEMP% is in the path before the normal system folders, HelpCtr.exe in %TEMP% will load the malicious msimg32.dll from the current directory (%TEMP%) rather than the Microsoft-provided copy in the system folder.

This is similar to the technique used by targeted malware attacks that piggybacked on NVIDIA’s digital signature.

The malware then invokes HelpCtr.exe from the %Temp% directory using a very interesting mechanism. It sends a WM_HOTKEY message to the Shell_TryWnd window in order to run HelpCtr.exe.

By doing so the malware actually runs the “dll” branch of execution before it continues the “exe” branch of execution.

HelpCtr.exe can be started by using the hotkey combination of Win+F1. By passing these specific values to the lParam and wParam arguments, the dropper invokes that hotkey combination.

fig8 500

After doing that, the dropper deletes the copies it created in the %Temp% directory and restores the PATH variable.

check your help 500

 

Protecting disk sectors

Like other bootkits, Guntior will hook I/O request packet (IRPs) handlers in order to hide the existence of the malicious MBR that it writes to sector 0.

Most bootkits have followed the same architecture discussed in our Popureb white paper.

Guntior is slightly different in that, unlike other bootkits that hijack the I/O path by placing hooks in the miniport driver, it hooks the disk class drivers (disk.sys) IRP_MJ_READ and IRP_MJ_WRITE. This approach is not as deep as placing hooks in the miniport driver.

Normally the I/O path taken for an IRP flows from the storage class driver to the port driver which then interfaces with the miniport driver and back. So the miniport driver resides closer to the hardware than the storage class driver.

Bootkits like TDL4 and Popureb place their hooks in the miniport driver to achieve maximum control. Generally, hooking at such levels is done to subvert the attempts of security software to read and write to disk through storage filter drivers.

Hooked Disk driver IRPs

Hooked Disk driver IRPs

This is to hide the malicious MBR and instead return a clean view of the MBR when read.

Clean MBR view with hooks present

Clean MBR view when hooks are present

The hooks don’t actually reside inside the driver that the rootkit drops but rather in an allocated region of kernel memory.

Inside that region the code relies on a pivot function in order to find its location in memory and passes fixed offsets to the function to access imports and the structures that it requires.

Using this technique it accesses the original IRP table of the disk driver that it keeps intact to serve requests directed at the handlers that it hooks.

Clean IRP table stored

Clean IRP table stored

On unhooking the two IRP hooks we can actually see the malicious MBR.

Malicious MBR view after unhooking IRPs

Malicious MBR view after unhooking IRPs

This technique for hiding the malicious MBR by hooking IRPs has been commonly copied with little variation across different bootkits.

Analysis and information belong to nakedsecurity.sophos.com

Tags: bootkitGuntiormalwareMalware AnalysisMBRsophos
Share30Tweet19
Paul Anderson

Paul Anderson

Editor and chief at ZeroSecurity. Expertise includes programming, malware analysis, and penetration testing. If you would like to write for ZeroSecurity, please click "Contact us" at the top of the page.

Recommended For You

Syslogk Linux Rootkit triggers with magic packets

by Christi Rogalski
June 19, 2022 - Updated on June 20, 2022
0
Syslogk Linux Rootkit triggers with magic packets

Avast researchers have spotted a Linux rootkit that has the ability to hide malicious processes. The new Linux rootkit, called Syslogk, works by using magic packets to activate...

Read more

BlackCat Ransomware aka “ALPHV” infections on the rise

by Kyle
June 16, 2022
0
BlackCat Ransomware aka “ALPHV” infections on the rise

As the ransomware-as-a-service (RaaS) industry grows, more ransomware players come into the mix. BlackCat, also known as ALPHV, is a growing ransomware threat with the ability to target...

Read more

State-sponsored Iranian Hackers utilize .NET DNS Backdoor in new Attack

by Kyle
June 12, 2022
0
Lycaeum APT DNS hijacking backdoor

An Advanced Persistent Threat (APT) hacking group based out of Iran going by the name Lycaeum has been seen using a .NET-based DNS backdoor to target organizations within...

Read more

Emotet Banking Trojan Re-Emerges After Take Down by Law Enforcement

by Paul Anderson
June 10, 2022
0
Emotet Banking Trojan 2022

Botnet Emotet has re-emerged after being taken down by a multinational joint task force operation in January 2021. The developers behind Emotet have been given credit as one...

Read more

LuoYu Hacker Collective using New Techniques to Deploy WinDealer Backdoor

by Kyle
June 8, 2022
0
LuoYu Windealer advanced persistent threat actor

Researchers at Kaspersky Labs have discovered a new attack by Advanced persistent threat (APT) actor LuoYu utilizing the known malware WinDealer. WinDealer has the unique ability to perform...

Read more
Next Post
Kaspersky unveils most advanced Android Malware to date

Kaspersky unveils most advanced Android Malware to date

Related News

Downthem DDoS Service owner sentenced

Downthem DDoS service owner gets a 2-year prison sentence

June 30, 2022
Cloudflare record breaking DDoS

Cloudflare Stops Record-Breaking DDoS

June 29, 2022
Syslogk Linux Rootkit triggers with magic packets

Syslogk Linux Rootkit triggers with magic packets

June 19, 2022 - Updated on June 20, 2022
Zerosecurity

We cover the latest in Information Security & Blockchain news, as well as threat trends targeting both sectors.

Categories

  • Crypto
  • Data Breaches
  • DotNet Framework
  • Downloads
  • Exploits
  • Exploits
  • Information
  • Legal
  • Malware
  • Malware Analysis
  • Mobile Security
  • Paper Downloads
  • Piracy
  • Privacy
  • Programming
  • Public
  • Security
  • Security
  • Software & Service Reviews
  • Technology News
  • Tools
  • Tutorials
  • Video Tutorials
  • Whitepapers
  • Zero Security
  • Contact Us
  • List of our Writers

© 2022 ZeroSecurity, All Rights Reserved.

No Result
View All Result
  • Home
  • Security
    • Tools
  • Data Breaches
  • Malware
  • Privacy
  • Contact Us

© 2022 ZeroSecurity, All Rights Reserved.