Home Malware Programs Trojans Troj/JadKmem-A

Troj/JadKmem-A

Posted: June 12, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 4,560
First Seen: June 12, 2013
Last Seen: August 9, 2023
OS(es) Affected: Windows

Troj/JadKmem-A is a Trojan and the kernel memory infection that is connected with the Chinese bootkit Guntior. Guntior, unlike other bootkits that compromise the I/O path by setting hooks in the miniport driver, hooks the disk class drivers (disk.sys) IRP_MJ_READ and IRP_MJ_WRITE. This approach is not as deep as setting hooks in the miniport driver. Usually, the I/O path taken for an IRP flows from the storage class driver to the port driver which then interfaces with the miniport driver and back. So the miniport driver resides closer to the hardware than the storage class driver. Bootkits set their hooks in the miniport driver to achieve maximum control. In general, hooking at such levels is done to subvert the attempts of security tools to read and write to disk through storage filter drivers. This is to disguise the malevolent MBR and instead return a clean view of the MBR when read. The hooks don't actually reside inside the driver that the rootkit distributes but rather in an allocated region of kernel memory.

Loading...