Recently, a sample of the BlackEnergy Trojan has been uploaded on Googles VirusTotal service, that offers free scanning of files with multiple antivirus engines. It is a modification of the previous threat, which, according to F-Secure, has distanced from the characteristics of a rootkit since hiding of files and registries is no longer carried out; however, the analyzed sample does include latent routines that hide processes. These rely on direct kernel object manipulation (DKOM), a …
Comments are closed.
