Rustock C The Beast

[evilcry]

Hi,

Rustock C is definitely the most powerful advanced rootkit for Windows ever seen, the Pure Evil

Here some papers about it

http://info.drweb.com/show/3342/en

http://www.rootkit.com/newsread.php?newsid=879

http://blog.threatexpert.com/2008/05/rusto...ested-doll.html

http://blog.threatexpert.com/2008/06/new-r...to-hotmail.html

* Sophisticated polymorphic protection of the rootkit makes extraction and analysis extremely difficult.

* Implemented as a driver, it runs on the lowest kernel level.

* Protects itself, prevents runtime changes.

* Uses active anti-debugging techniques: monitors setting hardware breakpoints (DR-registers), disrupts operation of kernel-level debuggers (e.g. Syser, SoftIce). WinDbg debugger won

Edited June 8, 2008 by evilcry

[Shub-Nigurrath]

nice infos mate, will come handly..

[aztecx]

thats amazing heh...

i wonder how long it would take to code something like this & who would have this much knowledge?...

What programming language do you think was used?

Edited August 25, 2008 by aztecx

[evilcry]

You need to have great knowledge of Windows Internals and high Driver Coding Skills

What programming language do you think was used?

eheh easy the only languages that can be used into a driver, C and Assembler

Regards,

Evilcry

[steve10120]

Nasty stuff Rustock, is actively being used by a Russian adware company, should be able to find their copy if anyone wants it to analyze.

[GamingMasteR]

I'm developping a new kernel-mode stuff tool .. it would be appreciated if some1 send me a copy of the rk .

[Armaked0n]

@GamingMasteR:

you can download samples of this rootkit from http://www.offensivecomputing.net

[GamingMasteR]

Thanks very much Armaked0n

[F0X]

rustock D is even worse, it's coded in assembly btw

[Willi000]

Here is article from Kaspersky Lab:

http://www.viruslist.com/en/analysis?pubid=204792011

[evilcry]

Hi,

If you're intersted in Rootkit Technology, search also for Srizbi Rk that is really efficient

Regards,

Evilcry

[steve10120]

Nice breakdown of it @ http://www.rootkit.com/newsread.php?newsid=879.

[aztecx]

Nice breakdown of it @ http://www.rootkit.com/newsread.php?newsid=879.

he already linked us to that in the first post.

[steve10120]

Sorry didn't see it.

[steve10120]

Sorry for the double post.

I found this while analyzing some Russian adware, could be a new rustock variant.

Sandbox:

http://www.threatexpert.com/report.aspx?md...01324aae844a773

Password: infected

Download:

http://rapidshare.com/files/158005746/infected1.rar.html - rename .ppp to .exe of course.

Waiting for Kaspersky to mail me back with a detection notice.

[evilcry]

Hello,

Here an intersting paper on Rustock.C

http://www.reconstructer.org/papers/Rustoc...omes%20true.pdf

@steve10120: Thank you for the sample, I'll give it a look.

Regards,

Giuseppe 'Evilcry' Bonfa'

[steve10120]

No probs, although apparently that link has reached its 10 download limit, here a fresh one.

http://sharebee.com/e3bfcd5d

And a analysis of it @ http://novirusthanks.org/blog/?p=150.

I have the packed/obfuscated driver if any of you fancies unpacking it.