CeidPageLock: A Chinese RootKit

guest · Aug 29, 2018

CeidPageLock: A Chinese RootKit
August 28, 2018
https://research.checkpoint.com/ceidpagelock-a-chinese-rootkit/

The rootkit was first discovered by 360 Security Center a few months ago [...] CEIDPageLock is – a browser hijacker. It acts to manipulate the victim’s browser and turn their home-page into a site pretending to be 2345.com – a Chinese web directory.

The dropper’s main responsibility is to extract the driver which resides within the file and to save it in “\\Windows\\Temp” directory with the name “houzi.sys” [...]

The dropped driver has a certificate signed by [...] although, this certificate has actually been revoked by the issuer.

The driver is a 32-bit kernel-mode driver that is launched among the standard system drivers during startup. The driver is fairly stealthy, employing tricks to evade and hide from endpoint security products.
[...] the ability to execute code on an infected device while operating from the kernel, coupled with the persistence of the malware, makes it a potentially perfect backdoor.
Click to expand...

Log in or Sign up

CeidPageLock: A Chinese RootKit

guest Guest

Log in or Sign up

CeidPageLock: A Chinese RootKit

guest Guest

Useful Searches