About Rootkit Analytics

Rootkit Analytics [RkA] - the science of rootkit analysis, is a web-portal sculptured to enhance research, analysis and development of rootkit defense mechanisms. There are many unsolved problems in this world, one of which has been rootkit analysis. This is due to the fact that the ongoing war between good and the bad is never ending. With that being the case, RkA is aiming to provide solutions and services in analysis and mitigation of rootkits.

EvilFingers Arsenal

Socialize with RootkitAnalytics

Links

Rootkits & Enterprise: Enterprise is a major victim to rootkits. What could rootkits do to them?[read more]

Rootkits & Home-users: Do home-users know the seriousness of rootkits? What should a home-user know about rootkits?[read more]

Rootkits & Information Warfare: What does the silent war of intelligence and national security, got to do with rootkit analysis?[read more]

Userland Rootkits: What should one know about userland rootkits?[read more]

Kernelland Rootkits: What should one know about kernelland rootkits?[read more]

ElfStat: ElfStat is a tool designed for detecting any kernel malware that modifies the text segment of the kernel in memory...[read more]

Syscall/Kernel function interception: This is a more stealth method of syscall hijacking without having to directly modify the syscall table; instead the first several bytes of the syscall are overwritten with a jump to the new code...[read more]

Syscall Interception: What should you know about Syscall interception by directly modifying the Syscall table?[read more]

KsiD [Kernel Symbol Interception Detection]: This tool is designed to detect kernel rootkits and kernel malware which hijack syscalls and kernel functions ...[read more]

IDT /dev/kmem rootkit method: This can be done using several methods including overwriting the first several bytes of the syscall with a jump to other code, or modifying the function pointers.[read more]

Hidden Process Detection: Hidden Process Detection [HPD] using Direct NT System Call Implemenation, PIDB (Process ID Bruteforce) method, CSRSS Process Handle Enumeration and other methods...[read more]

Hidden Registry Detection: Reason for Hiding the Registry Entries, Rootkit techniques to hide, and Detecting Hidden Registry Entries Using Direct NT System Call Method and Directly Reading Hives Method...[read more]

Hidden Service Detection: Hidden Rootkit Services Detection Methods...Enumerating Processes with 'NtControlPipe', Hook Bypass Method through Mapped Image, Services Enumerating Child Processes of Services.exe, Enumerating Services Registry Key...[read more]

Syscall Handler Checker [SHC]: This tool simply verifies whether or not the system call handler system_call() has been patched to call a phony sys_call_table. If a phony sys_call_table appears to be in use, a tool like elfstat can be used for further analysis...[read more]

Firmware Rootkits: Firmware is a small static code that runs on devices ranging from consumer electronics to anything that controls heavy machinery...[read more]

Hypervisor Rootkits: This comes under both firmware and hardware rootkits. The reason being, hypervisor is a virtual environment that runs on the hardware, but basically it is a firmware. Hence, we have drawn the line and dropped this rootkit in the firmware category of rootkits...[read more]

Publications: In this section, we are planning to list all the papers that we have published so far that are rootkit related.

Backdoor Ultimate Defender: In this paper (Backdoor.Win32.UltimateDefender.gtz - Reversing) we analyze install.exe that presents the typical structure of an Medium Evoluted Malware, with basical Obfuscated-Dummy Code...[read more]

Socialize: You could socialize with us by many ways...[read more]

About: Learn about rootkit analytics here...[read more]

Contact us: How can you reach us...[read more]

Our Team: Read more about the rootkit analytics team...[read more]

dwtf v1.0: dwtf is a DLL copying engine ... [read more]

Exploring ADS: Alternate Data Stream (ADS) is the lesser known feature of Windows NTFS file system which...[read more]

Top Articles

Hidden Process Detection
Hidden Service Detection
Tools-Elfstat
Tools-KsiD
Hidden Registry Detection

Installations [from RootkitAnalytics.com]

ToolsCount
~~~~~~~~~~~~~~~~~~~
Elfstat3186
dwtf2348
KsiD2091
SHC1516

NOTE: Our tools are listed in many sites and torrents, which makes it hard for us to track all downloads. Hence, we are listing only the total installations from our website.

Socialize with EvilFingers

Tweets

RT @EvilFingers: The Pirate Bay returns, Anonymous hater takes credit for DDoS http://t.co/lToXLoUW

RT @mickmcavoy: Actually this has now trumped my previous intriguing comic book cover! #evilfingers http://t.co/HyuB26Wr

Actually this has now trumped my previous intriguing comic book cover! #evilfingers http://t.co/HyuB26Wr

@EvilFingers Sen Ruppersberger said the same thing about #CISPA. But his focus was on importance of info sharing #UMDCyber

@EvilFingers companies not reqd to clean data they vol give gov #UMDCyber

@EvilFingers companies not reqd to clean data they vol give gov

RT @EvilFingers: Cybersecurity Bill Runs Into Trouble: http://t.co/NdI0YlHF < According 2 Panel @ #UMDCyber on cyberlegislation (cont)

Tweeting Times Release http://t.co/qFIdqEqw - top stories by AnonymousPress, egyp7, EvilFingers

The Cybersecurity Daily is out! http://t.co/Z8G9X7Un ▸ Top stories today via @evilfingers @security_expert @amarshall_asi @anuesystems

Fun with #pcap again https://t.co/maCfpmfr

a k'wala's PrivSec Daily is out! http://t.co/swVv36jO ▸ Top stories today via @evilfingers @kaepora

My Tweeted Times http://t.co/FERk0sHU - top stories by threatpost, suffert, EvilFingers

#FF @yuridiogenes, @PrivateiAlbert, @dave_rel1k, @j0emccray, @Jabra, @hdmoore, @rodsoto, @cyb3rs3c, @EvilFingers

RT @evilfingers: Unrepentant Hippie and World Networker Randy Bush Enters Net’s Hall of Fame: Randy Bush, known for his volunteer......

RT @SecureThinking: @nesitct @zecurion @evilfingers @score4africa - Thanks for the mention, appreciated!

My Tweeted Times http://t.co/YR09QIG3 - top stories by CryptoCoinMedia, PrivacyMemes, EvilFingers

@nesitct @zecurion @evilfingers @score4africa - Thanks for the mention, appreciated!

The NESIT Daily is out! http://t.co/Q4W1RuHO ▸ Top stories today via @zecurion @evilfingers @score4africa @securethinking

top news from security list http://t.co/1RBZYhf6 - top stories by EvilFingers, nicolasbrulez, briankrebs

@Slad3G @EvilFingers It affects versions greater than 3.3 as well, just not for ssh or https.

RT @EvilFingers All RuggedCom equipment comes with a built-in backdoor: http://t.co/NY0mpXXX&lt; untrue only ROS 3.3 and below. ROX unaffected

v @cinnamon_carter: RT @EvilFingers: Adobe, Microsoft Push Critical Security Fixes http://t.co/umFv60zf

RT @cinnamon_carter: RT @EvilFingers: Adobe, Microsoft Push Critical Security Fixes http://t.co/QPayAeTj

RT @cinnamon_carter: RT @EvilFingers: Adobe, Microsoft Push Critical Security Fixes http://t.co/QPayAeTj

RT @EvilFingers: Adobe, Microsoft Push Critical Security Fixes http://t.co/QPayAeTj

FYI: #News #Infosec #Hacking --> http://t.co/KHvMBS1S - top stories by EvilFingers, quequero, a8h1m4nyu2

FBI wants backdoor to #Facebook, #Skype, & Instant Messaging http://t.co/vt0f3MLR via @teksquisite @EvilFingers @CyberSafety808