Malware Analysis: A Kernel Land Rootkit Loader for FK_Undead

Tags

External References

• https://www.gdatasoftware.com/
• https://otx.alienvault.com/

Description

This analysis delves into a Windows rootkit loader for the FK_Undead malware family, known for intercepting user network traffic through proxy manipulation. The loader, signed with a valid Microsoft certificate, installs itself as a system service and employs various evasion techniques. It downloads and decrypts a payload, which is another signed driver protected by VMProtect. The rootkit checks for security tools, virtual machine environments, and implements notify routines to hide from detection. It uses deaddrops to retrieve URLs for downloading the FK_Undead payload, which is then decrypted and installed as a separate kernel driver service.

Date