Loading malware…
Uroboros, also referred to in the content as Uroburos, is a sophisticated kernel-mode rootkit/malware framework attributed to the Turla APT group. The analyzed sample is identified with MD5 ed785bbd156b61553aaf78b6f71fb37b. The content describes Uroboros as a long-chain user-mode to kernel-mode implant designed for covert, long-term control, persistence, evasion, and stealthy monitoring on Windows systems, including Windows 7 x64.
Reported capabilities include registration of a process-creation callback via PsSetCreateProcessNotifyRoutine, enumeration of running processes via ZwQuerySystemInformation, and multi-stage injection into trusted processes including service.exe, svchost.exe, iexplore.exe, firefox.exe, and chrome.exe. The content states that this trusted-process and browser injection can support persistence, concealment, and interception of private information.
At kernel level, the content attributes multiple stealth techniques to Uroboros. One analysis concludes that the malware used a custom IDT hook shellcode tied to interrupt vector 0xC3, identified after an anomalous int 0C3h instruction was found inside nt!IoCreateDevice and the IDT was inspected with !idt -a. Another analysis reports overwritten SSDT entries and active SSDT hooking by a kernel-mode component, although a separate analysis in the same content later concludes that some initially suspicious SSDT observations on Windows 7 x64 were actually due to PatchGuard-related visibility limitations rather than confirmed hook overwrites. High-confidence reporting across the content therefore supports kernel tampering and stealth techniques, especially IDT-hook-based behavior, while some SSDT-hooking conclusions are presented inconsistently.
The content also states that Uroboros abuses legitimate Windows drivers, specifically ndis.sys and fwpkclnt.sys, by modifying kernel function pointers and redirecting execution to a malicious routine identified as sub_4AFBC. This is described as enabling stealthy network filtering, packet interception, persistence, and evasion. Communications are described as using a custom HTTP-based protocol implemented in function sub_3F23C, with parsing logic that checks a type value of 6, compares strings including "&a", and uses XOR-based decryption with a static table named unk_65D70 so traffic blends with normal internet activity.
Additional behavior noted in the content includes the appearance of Uroboros.sys as an unloaded module during debugging, persistence remaining active after reboot, and a BSOD triggered during analysis that the researcher interpreted as possible anti-analysis or anti-memory-forensics behavior. Another analysis focused on NtProtectVirtualMemory and reported anomalous behavior including unexpected NTSTATUS 0xC00000F1 (STATUS_SECTION_NOT_EXTENDED), debug breakpoints, and suspicious control flow, which the author characterized as possible status-based anti-analysis intended to mislead analysts, sandboxes, or EDR tooling.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Static Analysis of Turla’s Uroboros: Revealing Core Tactics and Technical Mindset
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Like many analysts, I began by assuming the most likely culprit: an SSDT (System Service Descriptor Table) hook. But the NtQuerySystemInformation function did not behave as expected. | the presence of int 0C3h inside IoCreateDevice, is absolutely not normal behavior... It told me IDT Hooking : Interrupt Descriptor Table (IDT) is used by the processor to manage interrupt handling... Hooking the int 0C3h interrupt vector in the IDT (Interrupt Descriptor Table)
The very long and deep execution chain and injection of design from user mode to kernel mode is top elite level... finally it uses PsSetCreateProcessNotifyRoutine to register NotifyRoutine for kernel callbacks; from there, the key point is to inject the whole design and hijack the new process created.
it highly confident this potential inline hooks or patches... NtProtectVirtualMemory was intercepted; it’s highly confident.
From the HTTP request parsing with a specific “type” (==6) and the code comparison with the strings “&a” and the XOR description routine, it is a typical XOR loop, using a static decryption table (unk_65D70). The input (e.g., from &a=) is probably encrypted, and this routine decrypts it.
The very long and deep execution chain and injection of design from user mode to kernel mode is top elite level... finally it uses PsSetCreateProcessNotifyRoutine to register NotifyRoutine for kernel callbacks; from there, the key point is to inject the whole design and hijack the new process created.
malware knows me, debugs, and does anti-memory forensics and anti-analysis strategies at a low level?
it’s clearly crafted to mislead sandboxes or researchers... malware deliberately returns valid but misleading NTSTATUS values to trick sandboxes, EDRs, or analysts
Like many analysts, I began by assuming the most likely culprit: an SSDT (System Service Descriptor Table) hook. But the NtQuerySystemInformation function did not behave as expected. | the presence of int 0C3h inside IoCreateDevice, is absolutely not normal behavior... It told me IDT Hooking : Interrupt Descriptor Table (IDT) is used by the processor to manage interrupt handling... Hooking the int 0C3h interrupt vector in the IDT (Interrupt Descriptor Table)
ndis.sys handles network traffic, and fwpkclnt.sys is part of the Windows Firewall; patching them is ideal for stealthy network filtering and intercepting packets.
The malware Uroboros uses ZwQuerySystemInformation to enumerate processes, find services such as service.exe, svchost.exe, and browsers (iexplore/firefox/chrome), and determine which is the best place to inject or hide by privilege.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
And also, including the IOC about Turla’s Uroboros, I did analysis before.
Advanced rootkit/implant family associated in the reference list with Turla and kernel-mode intrigue.
A sophisticated Turla-associated kernel-mode rootkit/backdoor that escalates into kernel space, registers process creation callbacks, injects into trusted processes such as svchost.exe and browsers, patches legitimate Windows drivers for stealthy network interception, and uses customized HTTP communications for covert long-term persistence and evasion.
Kernel-level malware associated in the report with stealthy interception of NtProtectVirtualMemory and status-based anti-analysis on Windows 7 x64, using deceptive NTSTATUS returns and PatchGuard-evasive techniques rather than classic SSDT hooking.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.