Rovnix bootkit returns with new features

guest · Jun 27, 2020

Rovnix bootkit returns with new features
June 25, 2020
https://www.itweb.co.za/content/WnxpEv4g1ZXqV8XL/pXnWJadMba7bjO1e

The notorious Rovinx bootkit – a malicious program created to load and protect malware from detection – has reared it’s ugly head again.

The Rovnix bootkit faded away in 2013 when its source code was leaked, making it available for analysis by security vendors and pretty much anyone else. Then, in mid-April 2020, Kaspersky’s threat monitoring systems detected malicious files containing the famous bootkit.
Click to expand...

Alexander Eremin, a security analyst at Kaspersky, says this threat shows us two things: that we can never be sure that an old threat will not return, and that cyber criminals really do adapt quickly.

“Our analysis shows that once the source code of a threat goes public, it can result in surprises, as in the case with Rovnix. Freed from the need to develop their own protection-bypassing tools from scratch, cyber criminals can pay more attention to the capabilities of their own malware and add extra ‘goodies’ to the source code.”
Click to expand...

Kaspersky: Oh, what a boot-iful mornin’

Rovnix bootkit back in business
In mid-April, our threat monitoring systems detected malicious files being distributed under the name “on the new initiative of the World Bank in connection with the coronavirus pandemic” (in Russian) with the extension EXE or RAR. Inside the files was the well-known Rovnix bootkit.

There is nothing new about cybercriminals exploiting the coronavirus topic; the novelty is that Rovnix has been updated with a UAC bypass tool and is being used to deliver a loader that is unusual for it. Without further ado, let’s proceed to an analysis of the malware according to the rules of dramatic structure.
Click to expand...

Log in or Sign up

Rovnix bootkit returns with new features

guest Guest

Log in or Sign up

Rovnix bootkit returns with new features

guest Guest

Useful Searches