Fu

Threat description

Details

CATEGORYRootkit

Summary

Fu is one of the most widely utilized rootkits in the wild. Other malware, such as rbot and sdbot variants, have used its features to hide themselves. Fu is a kernel-mode rootkit that modifies kernel data structures, which allows it to hide e.g. processes.

Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Fu rootkit does not try to hide itself on the compromised machine. Since it is not able to hide files, the hidden malware can still be detected and removed with signature-based AV scanners.

Fu rootkit is publicly available in binary and source code format. The technical information below is based on the public version.

Installation

The public version of Fu rootkit consists of two files: one executable file (.exe) and one kernel-mode driver file (.sys). The driver does the actual hiding where as the executable file is used to configure and command the driver.

Fu requires administrative privileges to install successfully. The executable file installs and loads the driver. This results in one registry key:

  • HKLM\SYSTEM\CurrentControlSet\Services\[driver_name]

where [driver_name] represents the name of the driver file without the .sys extension.

Hiding Technique

Fu allows the intruder to hide information from user-mode applications and even from kernel-mode modules. Following items can be hidden:

  • Processes
  • Kernel-mode modules

Fu hides information by directly modifying certain kernel data structures used by the operating system. Specifically, it removes to-be-hidden entries from two linked lists with symbolic names: PsActiveProcessHead and PsLoadedModuleList.

In addition, Fu is able to modify a process' token to change its security context. This has two impacts on the compromised system. First, it can modify privileges and access rights of any running process. Second, it can fool security auditing by replacing the owner SID of any running process.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info