Nathan

This kernel rootkit takes its C2 commands through the Windows registry. It registers a CmRegisterCallbackEx routine, then the user-mode agent writes commands into a benign key using nothing but standard registry APIs. Every write gets checked for the magic value 0x2625B7146B and the command is unpacked from it. No IOCTL. No DeviceIoControl. No named pipe. Nothing on the user-mode side that looks like it is talking to a driver at all. The command set behind it is a full kernel toolkit: arbitrary physical memory read and write by building a custom page table and injecting it into a free PML4 slot, PFN database reads, KVA shadow bypass, kernel APC DLL injection, ETW and CKCL and syscall table hooks, HvlGetQpcBias and GetCpuClock patched for timing. Then the HWID spoofing shows up. Disk, Nvidia GPU, SMBIOS, plus forged mouhid and i8042prt input packets. This started life as a game cheat driver. The cheat scene has been shipping production grade kernel capability for a decade and it keeps getting laundered into malware. Author: @xeroxsec Full analysis, IOCs and a YARA rule by 0xSec: 0xsec.gitbook.io/0xsec/malwa… The C2 infrastructure was still live and unflagged on VirusTotal at time of writing.