Sec
Lookup
Search
MITRE ATT&CK
software (malware)
S0135
HIDEDRV
Published 2017-05-31
Modified 2024-11-17
Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2017-05-31
Description
HIDEDRV
is a rootkit used by
APT28
. It has been deployed along with
Downdelph
to execute and hide that malware.
Related
Uses · MITRE ATT&CK
(2)
T1055.001
Dynamic-link Library Injection
sub-technique
T1014
Rootkit
technique
Referenced by MITRE ATT&CK · uses
(1)
G0007
APT28
group
References
http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf
ESET Sednit Part 3
https://web.archive.org/web/20180202163754/http://www.sekoia.fr/blog/wp-content/uploads/2016/10/Rootkit-analysis-Use-case-on-HIDEDRV-v1.6.pdf
Sekoia HideDRV Oct 2016