Summary
Rootkit:W232/HacDef is the detection name for Hacker Defender, a user-mode rootkit that modifies several Windows and Native API functions to allow it to hide information from other applications.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Alternatives
If a suspicious hidden file is detected and FSAV does not immediately remove the file, there are several actions you can perform by manually selecting one of the displayed option:
- If you don't want to do anything about the hidden item, select "None" as the action
- If you don't want to be notified about the file in the future, select "Exclude" as the action
- If you are sure the item is not part of a normal program, you can rename it by selecting "Rename" as the action. This will prevent the hidden program from starting in the future. You should use the "Rename" action very carefully, because renaming important files may break the computer.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
- Check for the latest database updatesFirst, check if your F-Secure security program is using the latest updates, then try scanning the file again.
- Submit a sampleAfter checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
- Exclude a file from further scanningIf you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.Note: You need administrative rights to change the settings.
Technical Details
Hacker Defender also implements a backdoor and port redirector that operates through TCP ports opened by existing services. This means it is not possible to find the hidden backdoor through traditional means, like launching a remote port scan against the compromised machine. Hacker Defender is one of the most widely deployed rootkits in the wild. it is publicly available in both in binary and source code format. There also exist private versions which have been customized the attacker's demands. These private rootkits might include features such as:
- Logoner for collecting user logon credentials
- Internal inifile for embedding the inifile into the executable
- Antidetection engine for circumventing modern rootkit detectors
The technical information below is based on the public versions.
Installation
Hacker Defender consists of two files: one executable file (.exe) and one configuration file (.ini). The configuration file is used to define the criteria for hiding items and to specify how certain rootkit components will be named when they are installed into the system. The rootkit requires administrative privileges to install. To do so, it installs itself as a service, which will start automatically during system startup. In addition, Hacker Defender installs and loads a kernel-mode driver that implements two support functions utilized by the user-mode components. First, it adds system privileges into every process defined as a root process in the configuration file. Second, it helps the rootkit’s user-mode components identify any handle pointing to a hidden object.
Infection
On execution, Hacker Defender infects every running process by allocating memory from the remote process and writing the payload directly into it. It then installs the inline hooks by patching function entry points with relative jumps pointing to the payload. When the infected process dynamically loads any of the above-mentioned DLLs or creates a new process, the payload makes sure they will also get infected. To successfully infect a system, the rootkit has to be executed with administrative privileges.
Stealth
Hacker Defender allows the intruder to hide the following items to conceal information from other user-mode applications:
- Files
- Processes
- Registry keys and values
- System services and drivers
- Allocated memory
- Handles
- Inbound and outbound TCP connections
Criteria for the hidden items are defined in the configuration file. Hacker Defender hides information by modifying the execution path of the following hooked Windows and Native API functions :
Ntdll.dll:
- NtQuerySystemInformation
- NtOpenProcess
- NtQueryDirectoryFile
- NtVdmControl
- NtCreateFile
- NtOpenFile
- NtQueryVolumeInformationFile
- NtEnumerateKey
- NtEnumerateValueKey
- NtReadVirtualMemory
- NtDeviceIoControlFile
- NtResumeThread
- LdrInitializeThunk
- LdrLoadDll
Kernel32.dll:
- ReadFile
AdvApi32.dll:
- EnumServiceGroupW
- EnumServicesStatusExW
- EnumServicesStatusExA
- EnumServicesStatusA
Ws2_32.dll:
- Recv
- WSARecv
This technique allows the rootkit to alter data passing to and from the hooked function.
Registry
During installation the rootkit drops a driver (.sys) to the same directory, loads it and creates two registry keys:
- HKLM\SYSTEM\CurrentControlSet\Services\[service_name]
- HKLM\SYSTEM\CurrentControlSet\Services\[driver_name]
In addition, Hacker Defender makes sure it will be executed also in safe mode by adding the following registry keys:
- HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\[service_name]
- HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\[service_name]
It should be noted that strings [service_name] and [driver_name] can be defined by the intruder in the configuration file. In addition, common tools will not be able to show the registry keys if the rootkit is active.
Protect your devices from malware with F‑Secure Total
Protecting your devices from malicious software is essential for maintaining online security. F‑Secure Total makes this easy, helping you to secure your devices in a brilliantly simple way.
- Award‑winning antivirus and malware protection
- Online browsing, banking, and shopping protection
- 24/7 online identity and data breach monitoring
- Unlimited VPN service to safeguard your privacy
- Password manager with private data protection
Choose how many devices you want to protect to get started.
- Free customer support
- Cancel anytime
- The trial does not obligate you to buy the product
After 30 days your subscription will renew automatically for one year at €69.99.
)
)
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.