Loading malware…
Rovnix is a Windows malware family best known for its bootkit architecture and later evolution into a broader data-stealing and payload-delivery platform. It was one of the earliest malware families to infect the NTFS Volume Boot Record in order to gain execution during system startup and load unsigned kernel-mode components on 64-bit Windows systems, giving it strong persistence and defense-evasion properties. Technical analyses have described Rovnix as the first known bootkit family to target the VBR in this way.
The family evolved through multiple variants and operational models. Early campaigns included extortion-oriented behavior such as blocking internet access and demanding payment, while later activity focused on credential and financial-data theft, encrypted command-and-control communications, and modular payload delivery. Some versions used hidden storage on disk, malicious drivers, and process injection into user-mode processes. Updated variants introduced polymorphic bootstrap code to hinder static detection, support for multiple payloads, and the ability to download and execute additional modules. More recent Rovnix-derived activity also incorporated privilege-bypass and DLL hijacking techniques, including abuse of auto-elevating Windows binaries, and deployed loaders and backdoor-style payloads capable of executing operator-supplied programs, recording audio, and controlling system power state.
Rovnix has been distributed through several mechanisms over time. Document-based lures and malicious archives have been observed, including themed social-engineering campaigns. Email-driven delivery has also been documented, sometimes using intermediary malware such as Andromeda or broader spam ecosystems to install Rovnix on victim systems. Campaign reporting has tied Rovnix distribution to large criminal infrastructures such as Avalanche and to spam-driven malware operations targeting countries including the United Kingdom, Poland, and Japan.
The malware family has longstanding links to the Eastern European cybercrime ecosystem. Reporting has connected the Rovnix framework to Carberp-associated developers and noted that its source code was leaked or sold, which likely enabled later reuse, modification, and resurgence. Because of that code leakage and overlap with other banking-trojan ecosystems, the name Rovnix has at times appeared in discussions alongside Gozi/ISFB, Ursnif, Zeus, and Carberp, though those families remain distinct despite shared code lineage or infrastructure relationships.
Rovnix primarily targets Microsoft Windows systems and has been used in financially motivated operations, especially those involving theft of payment or banking-related information. Across its lifespan, it has combined boot-level persistence, stealth, modular loading, and post-compromise payload execution, making it notable both as a historically important bootkit and as a reusable crimeware framework.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Rovnix was the first bootkit family to use VBR (Volume Boot Record) infection (NTFS bootstrap code) for loading unsigned kernel-mode drivers on x64 (64 bit) platforms.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
the malware creates and runs a series of BAT files that start wusa.exe from the fake directory and then clean up the traces
olevba is a script to parse OLE and OpenXML files such as MS Office documents (e.g. Word, Excel), to detect VBA Macros, extract their source code in clear text... | Detect suspicious VBA keywords often used by malware ... detect_suspicious checks if VBA macro code contains specific keywords often used by malware to act on the system
With the aid of the Windows API, the malware creates the directory C:\Windows \System32
AutoOpen | Runs when the Word document is opened ... Auto_Open | Runs when the Excel Workbook is opened ... Workbook_Open | Runs when the Excel Workbook is opened
overwrites the VBR with the bootloader, and places the packed original VBR next to it.
All bootkits aim to modify and subvert operating system components before the OS can be loaded. The most interesting target components are as follows: BIOS/UEFI, MBR (Master Boot Record) and the operating system boot loader.
KLoader is written to the disk; its purpose is to inject the payload into running processes.
This price is only for the bootkit package and excludes the cost of exploits for escalating privilege in order to get access allowing modifications deep into the system.
Most bootkit infections have used MBR-modification... The Rovnix family used other ways to infect with modification of the VBR
The first bootkits started to emerge on the malware scene as cybercriminals realized that bootkit development was a way in which they could increase the profitability of a kernel-mode rootkit by widening the range of its targets to include users of 64-bit machines.
This packet is XOR-encrypted with the single-byte key 0xF7
The file “on the new initiative of the World Bank in connection with the coronavirus pandemic.exe” is a self-extracting archive
KLoader is written to the disk; its purpose is to inject the payload into running processes.
clean up the traces by deleting the created directory and the easymule.exe dropper itself.
the malware ... copies there a legitimate signed executable file from C:\Windows\System32 ... (in this case, wusa.exe)
For synchronization reasons the payload generates the mutex: Global<Generated_string>.
overwrites the VBR with the bootloader, and places the packed original VBR next to it.
All bootkits aim to modify and subvert operating system components before the OS can be loaded. The most interesting target components are as follows: BIOS/UEFI, MBR (Master Boot Record) and the operating system boot loader.
So as to store payload and configuration information secretly Win32/Gapz implements hidden storage.
The base functionality of BkSetup.dll is centred on the process of infection and setting up the hidden storage partition.
The IPL code is loaded and executed by the VBR: thus, by modifying value of the ‘Hidden Sectors’ field, the malware is able to intercept execution flow at boot time.
The payload module includes functionality for downloading and executing additional modules from the C&C server... The C&C domain is rtttt-windows.com
it then starts a C&C communication cycle, within which a data packet about the infected device is generated... and sent to C&C.
Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.
It can steal user information and download a variety of other malicious software such as Zeus, Rovnix, Dyzap or Cutwail.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a complex threat that adopted TDL3’s hidden storage approach.
Mentioned as a name sometimes used in public reporting for ISFB-related activity.
Bootkit codebase referenced as a source of reused code within Downloader.Climax.A; the report does not claim full Rovnix deployment, but partial source reuse in the downloader implementation.
Named as one of the banking trojan strains tied to leaked Gozi source code.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.