Spam from the Kernel: Full-Kernel Malware Installed by MPack

lucas1985 · Jun 29, 2007

A malware that we discovered recently, Trojan.Srizbi is really interesting for some unique features. Trojan.Srizbi driver (windbg48.sys) has two main functions: hides itself using a Rootkit and sends spam, but the thing that makes it really unique is the fact that its probably the first full-kernel malware spotted in the wild.

Once the Trojan is installed, it works without any user mode payload and does everything from kernel-mode, including sending spam. The Rootkit code is not new: the malicious driver attaches itself to \FileSystem\Ntfs to hide files on the local disk and also patches an SDT table to hide registry keys in the same manner other older rootkits did before. Also, the Trojan attempts to delete %System%\Minidump log files and seems to include a special routine to uninstall competitor rootkits, such as “wincom32.sys” and “ntio256.sys”.

The most interesting code is contained in the spam routine. We know that using network functionalities directly from kernel-mode is much more complicated and we have seen many rootkit threats in the past - for example, Haxdoor, Rustock, and Peacomm - always carrying over a user-mode payload that gets injected into some Windows processes. Trojan.Srizbi seems to move a step forward by working totally in kernel-mode without the need to inject anything into user-mode.To manipulate the network connection directly in Kernel mode, it attaches NDIS and TCP/IP drivers and gets all the Ndis* and Zw* functions that it needs, which is unique to this threat. This technique also allows the Trojan to bypass firewall and sniffer tools, and to hide all its network activities.
Click to expand...

Symantec's weblog

The threat runs only in Kernel mode and uses rootkit techniques to hide files, registry keys, and network connections.

The rootkit hooks the following kernel functions to hide its registry keys:
ZwOpenKey
ZwEnumerateKey

It also hooks the following kernel routine of NTFS filesystem driver to hide its files: \FileSystem\Ntfs\IRP_MJ_CREATE
\FileSystem\Ntfs\IRP_MJ_DIRECTORY_CONTROL

It patches TCP/IP network drivers chain to bypass completely firewalls, IDS systems, and network sniffer tools.

The rootkit also works in Windows Safe Mode.
Click to expand...

Trojan.Srizbi Writeup
This is the "famous" Rustock.C

Meriadoc · Jun 29, 2007

working totally in kernal-mode

lucas1985 · Jun 30, 2007

Meriadoc said:

working totally in kernal-mode
Click to expand...

Unfortunately true

aigle · Jun 30, 2007

How to get it, lol!

fcukdat · Jun 30, 2007

lucas1985 said:

This is the "famous" Rustock.C
Click to expand...

I'm still awaiting confirmation of this but hoping to hear back shortly from some RK *experts*to confirm

http://forum.sysinternals.com/forum_posts.asp?TID=11261

SirMalware · Jul 2, 2007

Does not affect Windows 95, Windows 98, Windows Me

For once I feel safe in the Internet using 98SE.

lucas1985 · Jul 2, 2007

SirMalware said:

Does not affect Windows 95, Windows 98, Windows Me
Click to expand...

I'm not sure if EP_X0FF states that the whole malware doesn't work on 9x OSes or that this rootkit can't hide itself on Win 95/98/Me, thus not being a "true" rootkit.

SirMalware said:

For once I feel safe in the Internet using 98SE.
Click to expand...

LOL

Log in or Sign up

Spam from the Kernel: Full-Kernel Malware Installed by MPack

lucas1985 Retired Moderator

Meriadoc Registered Member

lucas1985 Retired Moderator

aigle Registered Member

fcukdat Registered Member

SirMalware Registered Member

lucas1985 Retired Moderator

Log in or Sign up

Spam from the Kernel: Full-Kernel Malware Installed by MPack

lucas1985 Retired Moderator

Meriadoc Registered Member

lucas1985 Retired Moderator

aigle Registered Member

fcukdat Registered Member

SirMalware Registered Member

lucas1985 Retired Moderator

Useful Searches