Original URL: https://www.theregister.com/2010/11/18/zeroaccess_rootkit_deconstructed/
Whitehat cracks notorious rootkit wide open
ZeroAccess no more
Posted in Security, 18th November 2010 04:00 GMT
A malware analyst has deconstructed a highly advanced piece of crimeware believed to be the work of the notorious Russian Business Network
The step-by-step instructions for reverse engineering the stealthy ZeroAccess rootkit is a blow to its developers, who took great care to make sure it couldn't be forensically analyzed. The tutorial means other malware researchers may also study the malware to close in on the people behind it and to better design products that can safeguard against it.
The analysis was written by Giuseppe Bonfa, a malware researcher specializing in reverse engineering at InfoSec Institute, an information security services company. It documents a rootkit that's almost impossible to remove without damaging the host operating system and uses low-level programming calls to create hard disk volumes that are virtually impossible to detect using normal forensic techniques. Sophos's description of the rootkit, which is also known as Smiscer, is here.
“This document shows the inner workings of a recent rootkit which has very advanced technologies,” Pierre-Marc Bureau, a researcher with antivirus provider Eset, wrote in an email. “This teaches a lot in terms of rootkit technologies, how these malware are operated (pay per download in this case), how they are installed on a system, and how they can be detected.”
According to Bonfa, malicious URLs unearthed from the disassembled rootkit use IP addresses associated with the Russian Business Network. ZeroAccess is currently being used as a platform for installing fake antivirus software, but it could obviously be used to force install any software of the author's bidding. ®