[Jaxryley]

I found that booting from a live cd and cutting/pasting the samples from system32/drivers to desktop the easiest way to harvest these.
http://www.microsoft.com/security/porta ... bnix.gen!A

Trojan:WinNT/Bubnix.gen!A is a generic detection for a kernel-mode driver installed by other malware that hides its presence on an affected computer by blocking registry and file access to itself. The trojan may report its installation to a remote server, download and distribute spam e-mail messages and could download and execute arbitrary files.

pnqsdnk.sys - 12 /43 - MS - Trojan:WinNT/Bubnix.gen!A
http://www.virustotal.com/file-scan/rep ... 1283472649

Bubnix.rar

Five samples
(3.73 MiB) Downloaded 794 times

[spaceman]

Hi, I'm looking for a recent sample of Rustock, can anyone help with that? Most of the samples on Offensivecomputing are pretty outdated. TIA.

[EP_X0FF]

Hello,

load this driver manually.

[spaceman]

Thank you. Since it dies on reboot, do you have a dropper or know of a way to make sure it survives?

After looking at the Wireshark traffic, It looks like it connected to a random Wikipedia article, per this article:

http://www.m86security.com/labs/traceit ... ticle=1362

[EP_X0FF]

Did you tried to set it as boot driver? I don't remember now, but earlier when I tried it survived reboots many times. It keeps few hooks and watchdog system thread, that overwrites rootkit driver file with small delay.

[spaceman]

Have you noticed any changes to the driver in the past few days? It looks like it no longer hooks the SSDT. I read some articles about the drop in Rustock spam related to an affiliate shutdown, but it seems like the rootkit itself has been updated as well. I'd be interested to know if people have observed similar changes.

[EP_X0FF]

Some AV vendors may mark Black Energy 2+ as Rustock.

[Jaxryley]

hxxp://www.freewebtown.com/giknow/trip.exe

trip.exe is dropping the new MSE ThinkPoint fake alert plus a couple of extras and seems to drop a slightly different .sys at each of the three installs I tried?

trip.exe - 9/43 - MD5 : d0ea36ea989162d1e527e0f69a391e6e
http://www.virustotal.com/file-scan/rep ... 1287922114

rnsumes.sys - 2/40 - Trojan:WinNT/Bubnix.gen!A - MD5 : b702fdcd2757b3a52731af724bc41c06
http://www.virustotal.com/file-scan/rep ... 1287921977

zmzazd.sys - 2/40 - Trojan:WinNT/Bubnix.gen!A - MD5 : 8ed7148f7084db3726a23bd880fcfe17
http://www.virustotal.com/file-scan/rep ... 1287921983

acijxydyq.sys - 2/37 - TR/Crypt.ZPACK.Gen - MD5 : 35dd69a628a14e519cf03c93645cfdd6
http://www.virustotal.com/file-scan/rep ... 1287924285

trip exe and droppers.rar

(3.31 MiB) Downloaded 103 times

[EP_X0FF]

Here is todays fresh sample of Rustock rootkit. Have no idea how it's now internally named and who is currently develops. Almost no changes since 2008 when I firstly saw it ITW.

DKOH + IRP Hooking (NTFS, Fastfat) + CmRegistryCallback.
Constantly hooks Key->ParseProcedure back if unhooked in watchdog system thread, so kill it first.

In attach dropper, driver it downloads and starts (rootkit itself) and exported driver registry data.