[rkhunter]

http://blogs.technet.com/b/mmpc/archive ... m-vfs.aspx
https://www.virustotal.com/en/file/f71a ... 399386647/
https://www.virustotal.com/en/file/a9a8 ... 399386812/

Extracted PE files + fixed dropper in attach.

[TouchMe]

I only had a quick look at the latest sample but here's some info.

Dropper drops and executes this very advanced batch file in order to melt.

Code: Select all

@ECHO OFF
:LOOP
timeout 5
DEL /Q /F "Sample.exe"
IF EXIST "Sample.exe" GOTO LOOP
DEL /Q /F %0
EXIT

After an undefined wait period the system will be infected and rebooted.
The virtual filesystem is now stored in a file on the hard disk, is accessible from usermode (lol), and some SSDT hooks are placed to protect it (lmfao).

SSDT Hooks:

NtCreateFile
NtCreateKey
NtDeleteFile
NtEnumerateKey
NtOpenFile
NtOpenKey
NtQueryDirectoryFile
NtQueryInformationFile
NtSetInformationFile
NtShutdownSystem

(jwivs.sys)

SCSI Port IRP hooks (inline jmp):

IRP_MJ_CREATE
IRP_MJ_CLOSE
IRP_MJ_DEVICE_CONTROL
IRP_MJ_INTERNAL_DEVICE_CONTROL
IRP_MJ_POWER
IRP_MJ_SYSTEM_CONTROL

(yurip.sys)

The bot appears to check for a large array of virtual machines, reversing tools and monitoring software, then does nothing with this information.
On windows 7 x64 there are BSODs from time to time and when loading certain drivers, XP 32-Bit gets stuck in BSOD loop. Payload is some crappy logger and ammyy stealer.

This clearly isn't the work of original rovnix coder, It's now a combination of advanced and retarded malware.

[ithurricane]

http://www.malwaretech.com/2014/05/rovn ... ution.html

[thisisu]

tsk0000 (TDSSKiller Quarantine) https://www.virustotal.com/en/file/6605 ... 403385668/

[rkhunter]

http://labs.bitdefender.com/2014/11/tracking-rovnix-2/

[SomeUnusedName]

For the record, I have no idea why anyone would call this Rovnix, this is a Gozi variant (ISFB Gozi) and behaves as such. Rovnix just adds major confusion. (speaking of the linked paper)

[Horgh]

Probably because they're idiots ? This is not in any way rovnix related, but hey, isn't a bootkit sexier than a old trojan ?
Other example of this bullshit : https://www.csis.dk/en/csis/news/4472/

Especially this :

The current version of Rovnix bootkit component has been removed and now only supports a user mode component.

Top fucking lel m8. I called them out on their bullshit but they don't give a shit, their clients aren't gonna know if their analysis are crap right ? If that was the case Trendmicro would surely have no clients anymore.

[Tigzy]

Assuming we have a Rovnix infection on a computer A, do you think it's safe to fix VBR with a VBR gotten from a computer B (same OS).
If I had to fix automatically, do you think I'd need a VBR copy of every OS?

[EP_X0FF]

Assuming we have a Rovnix infection on a computer A, do you think it's safe to fix VBR with a VBR gotten from a computer B (same OS).
If I had to fix automatically, do you think I'd need a VBR copy of every OS?

1) Why do you wasting your time on this crap? This legacy BIOS crap VBR IPL code is no longer used in modern OS and hardware, only volume geometry data.
2) What you doing is unwise, because VBR ($Boot) contain BPB with volume geometry unique for each volume.
3) Bootrec /fixboot or simple fixboot for old XP - problem solved.

I'm surprised no one answered for a day on this question.

[Tigzy]

1) Why do you wasting your time on this crap? This legacy BIOS crap VBR IPL code is no longer used in modern OS and hardware, only volume geometry data.

I know I'm late, but it's mostly for educational. Having it in my product is just a bonus.

2) What you doing is unwise, because VBR ($Boot) contain BPB with volume geometry unique for each volume.

I forgot to mention I wanted to replace only bootstrap + bootloader, leaving BPB alone and other non-assembly things untouched.

3) Bootrec /fixboot or simple fixboot for old XP - problem solved.

Yes I know :) I'm a little stubborn I have to admit. I want to do it myself and understand what I'm doing. :D

I just want to know if from a machine A to a machine B there's nothing in the assembly code that is strongly related to the machine.