1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Home
  2. Security
  3. Security Lab
  4. Latest Threats
  5. Virus Descriptions
  6. HacDef

HacDef

Name : HacDef
Category:Rootkit
Type:Rootkit
Platform:Win32

Summary

Hacker Defender is one of the most widely deployed rootkits in the wild. It is a user-mode rootkit that modifies several Windows and Native API functions, which allows it to hide information (files, processes, etc.) from other applications. In addition, Hacker Defender implements a backdoor and port redirector that operates through TCP ports opened by existing services. This means it is not possible to find the hidden backdoor through traditional means, like launching a remote port scan against the compromised machine.

Disinfection

Detection and Disinfection of Rootkits


F-Secure BlackLight engine is able to detect all files and processes that have been hidden by Hacker Defender rootkit. This includes the executable file (.exe), the driver (.sys) and the configuration file(.ini) that are part of the rootkit, but also any additional items defined by the intruder in the configuration file.

F-Secure BlackLight engine is able to disable the rootkit and thus allows other user-mode applications to get access to the hidden items.To proceed, follow the information below based on which version you are using:

F-Secure BlackLight Beta

See http://www.f-secure.com/blacklight/help/

F-Secure Internet Security 2006


Additional Details

Hacker Defender rootkit is publicly available both in binary and in source code format. The technical information below is based on the public versions. However, there also exists private versions of the rootkit that have been customized for the intruders needs. They might contain such features as:

  • Logoner for collecting user logon credentials
  • Internal inifile for embedding the inifile into the executable
  • Antidetection engine for circumventing modern rootkit detectors

Installation

The public version of Hacker Defender rootkit consists of two files: one executable file (.exe) and one configuration file (.ini). The configuration file is used to define the criteria for hiding items and to specify how certain rootkit components will be named when they are installed into the system.

Hacker Defender requires administrative privileges to install successfully. It installs itself as a service, which will start automatically during system startup. When it executes, it drops a driver (.sys) to the same directory. Then it installs and loads the driver. This results in two registry keys:

  • HKLM\SYSTEM\CurrentControlSet\Services\[service_name]
  • HKLM\SYSTEM\CurrentControlSet\Services\[driver_name]
In addition, Hacker Defender makes sure it will be executed also in safe mode by adding the following registry keys:

  • HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\[service_name]
  •  HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\[service_name]
It should be noted that strings [service_name] and [driver_name] can be defined by the intruder in the configuration file. In addition, common tools will not be able to show the registry keys if the rootkit is active.

Hiding Technique

Hacker Defender allows the intruder to hide information from other user-mode applications. Criteria for the hidden items are defined in the configuration file. Following items can be hidden:

  • Files
  • Processes
  • Registry keys and values
  • System services and drivers
  • Allocated memory
  • Handles
  • Inbound and outbound TCP connections
Hacker Defender hides information by modifying the execution path of several Windows and Native API functions. This allows it to alter data passing to and from the hooked function. Specifically, the following functions are hooked:

Ntdll.dll:

  • NtQuerySystemInformation
  • NtOpenProcess
  • NtQueryDirectoryFile
  • NtVdmControl
  • NtCreateFile
  • NtOpenFile
  • NtQueryVolumeInformationFile
  • NtEnumerateKey
  • NtEnumerateValueKey
  • NtReadVirtualMemory
  • NtDeviceIoControlFile
  • NtResumeThread
  • LdrInitializeThunk
  • LdrLoadDll
Kernel32.dll:

  • ReadFile
AdvApi32.dll:

  • EnumServiceGroupW
  • EnumServicesStatusExW
  • EnumServicesStatusExA
  • EnumServicesStatusA
Ws2_32.dll:

  • Recv
  • WSARecv
In addition, Hacker Defender installs and loads a kernel-mode driver that implements two support functions utilized by the user-mode components. First, it adds system privileges into every process defined as a root process in the configuration file. Second, it helps the rootkit’s user-mode components to identify any handle pointing to a hidden object.

Infection Technique

Hacker Defender infects every running process when it executes. To successfully infect a system, it has to be executed with administrative privileges. It allocates memory from the remote process and writes the payload directly into it. Then it installs the inline hooks by patching function entry points with relative jumps pointing to the payload.

When the infected process dynamically loads any of the above-mentioned DLLs or it creates a new process, the payload makes sure they will also get infected.