Malware

BackDoor.Gootkit.112

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

The Trojan can execute the following commands: ... Execute shell commands; Launch executables; Auto update.

T1574.001DLLEvidence1

BackDoor.Gootkit.112 uses the file apphelp.dll to create a fix database. The Trojan generates the database’s name and the value of the Application parameter randomly.

Persistence

2 techniques

T1112Modify RegistryEvidence1

Information about the payload module BackDoor.Gootkit.112 is stored in the Windows registry branch HKLMSOFTWARECXSW as binaryImage32 or binaryImage64

T1542.003BootkitEvidence1

all the functions have been grouped in the dropper, which alters the Volume Boot Record (VBR) code during the infection process. The driver, to which control is transferred by the VBR code prior to system initialisation

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

BackDoor.Gootkit.112 injects special shell code into the processes SERVICES.EXE, EXPLORER.EXE, IEXPLORE.EXE, FIREFOX.EXE, OPERA.EXE, and CHROME.EXE. Very few malicious programs inject their code by creating a new user mode thread involving CSRSS.EXE.

T1548.002Bypass User Account ControlEvidence1

To bypass the UAC and elevate its privileges in an infected system, BackDoor.Gootkit.112 employs a shim... The Trojan employs the SQL Server Client Network Utility (cliconfg.exe) whose manifest file has the attribute AutoElevate set to true... the fix database (shim) is installed in the system by means of sdbinst.exe whose manifest also has the parameter AutoElevate set to true

Stealth

3 techniques

T1055Process InjectionEvidence1

T1542.003BootkitEvidence1

T1574.001DLLEvidence1

BackDoor.Gootkit.112 uses the file apphelp.dll to create a fix database. The Trojan generates the database’s name and the value of the Application parameter randomly.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Information about the payload module BackDoor.Gootkit.112 is stored in the Windows registry branch HKLMSOFTWARECXSW as binaryImage32 or binaryImage64

Credential Access

1 technique

T1040Network SniffingEvidence1

The Trojan can execute the following commands: Intercept http traffic

Discovery

4 techniques

T1033System Owner/User DiscoveryEvidence1

The Trojan can execute the following commands: ... Acquire the list of local users and groups

T1040Network SniffingEvidence1

The Trojan can execute the following commands: Intercept http traffic

T1057Process DiscoveryEvidence1

The Trojan can execute the following commands: ... Acquire the list of running processes

T1083File and Directory DiscoveryEvidence1

The Trojan can execute the following commands: ... Block specific URLs

Collection

1 technique

T1113Screen CaptureEvidence1

The Trojan can execute the following commands: ... Take screenshots

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

they enable the backdoor to execute commands from a remote server and download additional modules stored in the Windows registry, similarly to the main module of BackDoor.Gootkit.112. The Trojan can execute the following commands

T1105Ingress Tool TransferEvidence1

The main objective of the injected shell code is to download the payload module from the system registry or from a remote server on the Internet.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

news drwebNews

Apr 9, 2014

BackDoor.Gootkit.112-a new multi-purpose backdoor

A complex multi-component backdoor/bootkit Trojan that alters the Volume Boot Record, injects shellcode into multiple processes, retrieves payloads from the registry or remote servers, bypasses UAC using Windows shims and auto-elevated binaries, and uses a large Node.JS-based payload to execute remote commands, intercept HTTP traffic, inject code, block URLs, take screenshots, enumerate users/processes, execute shell commands, launch executables, and self-update.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

BackDoor.Gootkit.112

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

The Trojan can execute the following commands: ... Execute shell commands; Launch executables; Auto update.

T1574.001DLLEvidence1

BackDoor.Gootkit.112 uses the file apphelp.dll to create a fix database. The Trojan generates the database’s name and the value of the Application parameter randomly.

Persistence

2 techniques

T1112Modify RegistryEvidence1

Information about the payload module BackDoor.Gootkit.112 is stored in the Windows registry branch HKLMSOFTWARECXSW as binaryImage32 or binaryImage64

T1542.003BootkitEvidence1

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

T1548.002Bypass User Account ControlEvidence1

Stealth

3 techniques

T1055Process InjectionEvidence1

T1542.003BootkitEvidence1

T1574.001DLLEvidence1

BackDoor.Gootkit.112 uses the file apphelp.dll to create a fix database. The Trojan generates the database’s name and the value of the Application parameter randomly.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Information about the payload module BackDoor.Gootkit.112 is stored in the Windows registry branch HKLMSOFTWARECXSW as binaryImage32 or binaryImage64

Credential Access

1 technique

T1040Network SniffingEvidence1

The Trojan can execute the following commands: Intercept http traffic

Discovery

4 techniques

T1033System Owner/User DiscoveryEvidence1

The Trojan can execute the following commands: ... Acquire the list of local users and groups

T1040Network SniffingEvidence1

The Trojan can execute the following commands: Intercept http traffic

T1057Process DiscoveryEvidence1

The Trojan can execute the following commands: ... Acquire the list of running processes

T1083File and Directory DiscoveryEvidence1

The Trojan can execute the following commands: ... Block specific URLs

Collection

1 technique

T1113Screen CaptureEvidence1

The Trojan can execute the following commands: ... Take screenshots

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

T1105Ingress Tool TransferEvidence1

The main objective of the injected shell code is to download the payload module from the system registry or from a remote server on the Internet.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

news drwebNews

Apr 9, 2014

BackDoor.Gootkit.112-a new multi-purpose backdoor

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.