A forum for reverse engineering, OS internals and malware analysis 

WinNT/Rovnix (alias Mayachok, Cidox, BkLoader)

Forum for analysis and discussion about malware.

WinNT/Rovnix (alias Mayachok, Cidox, BkLoader)

 #7055  by rkhunter
 Mon Jul 04, 2011 10:25 am
New bootkit with fraud component - browser banner.

Image

VT report: http://www.virustotal.com/file-scan/rep ... 1309773726

Unusual infection method of VBR.
Also successfully working in x64.
DrWeb Beta Scanner successfully cure it.
Mentioned in (while only on Russia) http://forum.drweb.com/index.php?showto ... ntry530621

Re: Trojan.Mayachok.2

 #7061  by EP_X0FF
 Mon Jul 04, 2011 1:42 pm
IntMayak.dll as payload?

fixboot?

Re: Trojan.Mayachok.2

 #7094  by EP_X0FF
 Wed Jul 06, 2011 4:15 am
Thanks for sample.

In attach driver it stores in the first sectors of the disk, payload dll (seems not much changed since IntMayak v1) binded with driver.
CreateProcess, LoadImage notify callbacks in place (firefox.exe opera.exe chrome.exe as targets of dll injection and svchost.exe iexplore.exe firefox.exe opera.exe chrome.exe for x64 version).

Also in attach Mayachok.1 with extracted payload dll.
d:\work\projects\bk2\kloader\Release\i386\kloader.pdb
d:\work\projects\bk2\kloader\Release\amd64\kloader.pdb
Infected volume boot record attached also.

Overall not impressive. :?
Fixboot, Amen.
Attachments
pass: malware
(4.05 KiB) Downloaded 222 times
pass: malware
(122.45 KiB) Downloaded 277 times

Re: Trojan.Mayachok.2

 #7096  by EP_X0FF
 Wed Jul 06, 2011 9:29 am
x64 driver attached.

This rootkit added to x64 rootkits thread list.
Attachments
pass: malware
(22.28 KiB) Downloaded 233 times
  • 1
  • 2
  • 3
  • 4
  • 5
  • 9
 Return to “Malware”